Analysis
-
max time kernel
74s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
07-02-2022 15:49
Static task
static1
Behavioral task
behavioral1
Sample
4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe
Resource
win10-en-20211208
General
-
Target
4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe
-
Size
3.6MB
-
MD5
b47f7078ad0d69e7fb52a6a3b8d8e2e1
-
SHA1
7024bbf3880f61a8bb00b25c83ed369c2a6cf0d5
-
SHA256
4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39
-
SHA512
d88954c5f4854025efaff069b9eceea9d800c8ff531461bb70f2105499629df1d4d62e11ec799054ca78a5d9415cf57e34bcc3efc3838f8ead88b3a8b92fdb28
Malware Config
Extracted
redline
install
46.51.151.97:14313
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2100-123-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2712 created 1704 2712 WerFault.exe 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exedescription pid process target process PID 1704 set thread context of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2712 1704 WerFault.exe 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exeAppLaunch.exepid process 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2712 WerFault.exe 2100 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeAppLaunch.exedescription pid process Token: SeRestorePrivilege 2712 WerFault.exe Token: SeBackupPrivilege 2712 WerFault.exe Token: SeDebugPrivilege 2712 WerFault.exe Token: SeDebugPrivilege 2100 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exedescription pid process target process PID 1704 wrote to memory of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe PID 1704 wrote to memory of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe PID 1704 wrote to memory of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe PID 1704 wrote to memory of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe PID 1704 wrote to memory of 2100 1704 4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe"C:\Users\Admin\AppData\Local\Temp\4ecf4dac9966f1cb45a2fa867c3f7e63736b6d377a9f16c9b36696405ce5ce39.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 5402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1704-128-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1704-115-0x00000000026D0000-0x0000000002711000-memory.dmpFilesize
260KB
-
memory/1704-116-0x0000000000400000-0x000000000096A000-memory.dmpFilesize
5.4MB
-
memory/1704-118-0x0000000000400000-0x000000000096A000-memory.dmpFilesize
5.4MB
-
memory/1704-117-0x0000000000400000-0x000000000096A000-memory.dmpFilesize
5.4MB
-
memory/1704-119-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1704-120-0x0000000000400000-0x000000000096A000-memory.dmpFilesize
5.4MB
-
memory/1704-114-0x0000000000400000-0x000000000096A000-memory.dmpFilesize
5.4MB
-
memory/2100-135-0x00000000097D0000-0x00000000097D1000-memory.dmpFilesize
4KB
-
memory/2100-142-0x0000000009FD0000-0x000000000A036000-memory.dmpFilesize
408KB
-
memory/2100-133-0x000000000BB20000-0x000000000BB32000-memory.dmpFilesize
72KB
-
memory/2100-134-0x000000000BC50000-0x000000000BD5A000-memory.dmpFilesize
1.0MB
-
memory/2100-123-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2100-136-0x0000000009D20000-0x0000000009D5E000-memory.dmpFilesize
248KB
-
memory/2100-137-0x0000000009B50000-0x0000000009B9B000-memory.dmpFilesize
300KB
-
memory/2100-132-0x000000000A2F0000-0x000000000A8F6000-memory.dmpFilesize
6.0MB
-
memory/2100-143-0x000000000C260000-0x000000000C75E000-memory.dmpFilesize
5.0MB
-
memory/2100-146-0x000000000BBC0000-0x000000000BC36000-memory.dmpFilesize
472KB
-
memory/2100-147-0x000000000BE00000-0x000000000BE92000-memory.dmpFilesize
584KB
-
memory/2100-148-0x000000000BD60000-0x000000000BD7E000-memory.dmpFilesize
120KB
-
memory/2100-153-0x000000000C930000-0x000000000CAF2000-memory.dmpFilesize
1.8MB
-
memory/2100-154-0x000000000D030000-0x000000000D55C000-memory.dmpFilesize
5.2MB
-
memory/2100-423-0x000000000C860000-0x000000000C8B0000-memory.dmpFilesize
320KB
-
memory/2100-428-0x00000000097D1000-0x00000000097D2000-memory.dmpFilesize
4KB