Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 14:07
Static task
static1
Behavioral task
behavioral1
Sample
e2268af5897931648b99818650d06eed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e2268af5897931648b99818650d06eed.exe
Resource
win10-en-20211208
General
-
Target
e2268af5897931648b99818650d06eed.exe
-
Size
846KB
-
MD5
e2268af5897931648b99818650d06eed
-
SHA1
0eee1a8c4a06160c01cdd72a9675f77cd441adec
-
SHA256
74768564ea2ac673e57e937f80c895c81d015e99a72544efa5a679d729c46d5f
-
SHA512
e0df61ebd86576eab80637871be622f9fe66ec0a86bb043f2ca93901e4735a4b427a5a50b4d5cfc425863649a1565b383b4478036bf220d0dd72b0641cf44cea
Malware Config
Extracted
redline
CrypTS
91.243.32.69:6941
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-61-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1612-62-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1612-63-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1612-64-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e2268af5897931648b99818650d06eed.exedescription pid process target process PID 1684 set thread context of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e2268af5897931648b99818650d06eed.exeAddInProcess32.exepid process 1684 e2268af5897931648b99818650d06eed.exe 1684 e2268af5897931648b99818650d06eed.exe 1684 e2268af5897931648b99818650d06eed.exe 1684 e2268af5897931648b99818650d06eed.exe 1684 e2268af5897931648b99818650d06eed.exe 1612 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e2268af5897931648b99818650d06eed.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1684 e2268af5897931648b99818650d06eed.exe Token: SeDebugPrivilege 1612 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e2268af5897931648b99818650d06eed.exedescription pid process target process PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe PID 1684 wrote to memory of 1612 1684 e2268af5897931648b99818650d06eed.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2268af5897931648b99818650d06eed.exe"C:\Users\Admin\AppData\Local\Temp\e2268af5897931648b99818650d06eed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1612-65-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/1612-66-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1684-55-0x00000000002A0000-0x0000000000378000-memory.dmpFilesize
864KB
-
memory/1684-56-0x0000000004270000-0x0000000004318000-memory.dmpFilesize
672KB
-
memory/1684-57-0x0000000000880000-0x000000000089A000-memory.dmpFilesize
104KB
-
memory/1684-58-0x0000000001E70000-0x0000000001E71000-memory.dmpFilesize
4KB