Overview
overview
10Static
static
4LarvaLabsW...er.exe
windows7_x64
10LarvaLabsW...er.exe
windows10_x64
10ROGAIOSDK.dll
windows7_x64
3ROGAIOSDK.dll
windows10_x64
3RofPaketsoka.dll
windows7_x64
1RofPaketsoka.dll
windows10_x64
3ssleay32.dll
windows7_x64
1ssleay32.dll
windows10_x64
1storarc.dll
windows7_x64
1storarc.dll
windows10_x64
1storelib.dll
windows7_x64
1storelib.dll
windows10_x64
3storelibir-2.dll
windows7_x64
1storelibir-2.dll
windows10_x64
3Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
16-12-2021 16:12
Behavioral task
behavioral1
Sample
LarvaLabsWallet Launcher.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
LarvaLabsWallet Launcher.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
ROGAIOSDK.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
ROGAIOSDK.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
RofPaketsoka.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
RofPaketsoka.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
ssleay32.dll
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
ssleay32.dll
Resource
win10-en-20211208
Behavioral task
behavioral9
Sample
storarc.dll
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
storarc.dll
Resource
win10-en-20211208
Behavioral task
behavioral11
Sample
storelib.dll
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
storelib.dll
Resource
win10-en-20211208
Behavioral task
behavioral13
Sample
storelibir-2.dll
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
storelibir-2.dll
Resource
win10-en-20211208
General
-
Target
LarvaLabsWallet Launcher.exe
-
Size
323.2MB
-
MD5
b18eaff37a9918535852c276a9f5f409
-
SHA1
e97ec59bec67c561774bc34b7275b5b644ff4864
-
SHA256
09383bbfa1491809d7d427c540221488ecc891196da1ce134fe5f145f8734abe
-
SHA512
2b5a822481b827a2eb6190812ff08ec79ade534a52221806b741d9b3ee9086e3e4bff8be85ad70dd0cd942a519ff1f5bf0406f8b046f3f80d5221a5a4627b92a
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3116-116-0x0000000000A30000-0x0000000000E64000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
LarvaLabsWallet Launcher.exepid process 3116 LarvaLabsWallet Launcher.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
LarvaLabsWallet Launcher.exepid process 3116 LarvaLabsWallet Launcher.exe 3116 LarvaLabsWallet Launcher.exe 3116 LarvaLabsWallet Launcher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
LarvaLabsWallet Launcher.exedescription pid process Token: SeDebugPrivilege 3116 LarvaLabsWallet Launcher.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-116-0x0000000000A30000-0x0000000000E64000-memory.dmpFilesize
4.2MB
-
memory/3116-117-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/3116-118-0x0000000076130000-0x00000000762F2000-memory.dmpFilesize
1.8MB
-
memory/3116-119-0x0000000076FC0000-0x00000000770B1000-memory.dmpFilesize
964KB
-
memory/3116-120-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/3116-121-0x0000000002500000-0x0000000002545000-memory.dmpFilesize
276KB
-
memory/3116-123-0x00000000737E0000-0x0000000073860000-memory.dmpFilesize
512KB
-
memory/3116-124-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/3116-125-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3116-126-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/3116-127-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/3116-128-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/3116-129-0x0000000075B50000-0x00000000760D4000-memory.dmpFilesize
5.5MB
-
memory/3116-130-0x0000000073FA0000-0x00000000752E8000-memory.dmpFilesize
19.3MB
-
memory/3116-131-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/3116-132-0x0000000073380000-0x00000000733CB000-memory.dmpFilesize
300KB
-
memory/3116-133-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/3116-134-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3116-135-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/3116-136-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3116-137-0x0000000005EE0000-0x0000000005EE1000-memory.dmpFilesize
4KB
-
memory/3116-138-0x00000000069B0000-0x00000000069B1000-memory.dmpFilesize
4KB
-
memory/3116-139-0x00000000070B0000-0x00000000070B1000-memory.dmpFilesize
4KB
-
memory/3116-140-0x0000000006B80000-0x0000000006B81000-memory.dmpFilesize
4KB