Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
23-03-2022 04:44
Static task
static1
Behavioral task
behavioral1
Sample
62434278.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
62434278.exe
Resource
win10v2004-20220310-en
General
-
Target
62434278.exe
-
Size
4.0MB
-
MD5
a9dcb01f21ef3159226eb0c179d26767
-
SHA1
31606eecdbb999c83908e3ac9cb3b64c43923992
-
SHA256
7dd0e4164bf63cdd163874c0f58e165362de6f109c2d750150c877f3018108c2
-
SHA512
5c7a4a6846514dd8eb3498d89a9d28519c6220654670c02e18aec2a6c28ad64db338c1a202052bb83c3f3d221c2ec2b713bd59705d35efaec21e7e331e9f4919
Malware Config
Extracted
redline
@JABKA9983
92.255.85.137:41320
-
auth_value
507a0c408947972b94cf44475f601269
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2612-138-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
4635_1647765460_726.exepid process 2788 4635_1647765460_726.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
62434278.exedescription pid process target process PID 2284 set thread context of 2612 2284 62434278.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 2612 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2612 AppLaunch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
62434278.exeAppLaunch.exedescription pid process target process PID 2284 wrote to memory of 2612 2284 62434278.exe AppLaunch.exe PID 2284 wrote to memory of 2612 2284 62434278.exe AppLaunch.exe PID 2284 wrote to memory of 2612 2284 62434278.exe AppLaunch.exe PID 2284 wrote to memory of 2612 2284 62434278.exe AppLaunch.exe PID 2284 wrote to memory of 2612 2284 62434278.exe AppLaunch.exe PID 2612 wrote to memory of 2788 2612 AppLaunch.exe 4635_1647765460_726.exe PID 2612 wrote to memory of 2788 2612 AppLaunch.exe 4635_1647765460_726.exe PID 2612 wrote to memory of 2788 2612 AppLaunch.exe 4635_1647765460_726.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62434278.exe"C:\Users\Admin\AppData\Local\Temp\62434278.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4635_1647765460_726.exe"C:\Users\Admin\AppData\Local\Temp\4635_1647765460_726.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4635_1647765460_726.exeMD5
0dc969799cd07a91d7d00825bf6d7e9e
SHA1dd21e9900ca37dad0ce236aa636cf5a5554dda56
SHA25649424ea75f90474c09ff21f52d86bbbbb9577e420c553f4dd942ac555cec938a
SHA512570e42808e9a0fe378ceee70fcbd0a18d23df19d0834056ef502268d7ef331def99806f2ceb53234f91caf936d53fe2dbff48dd9e6e82e5a3e245b98b7ec3455
-
C:\Users\Admin\AppData\Local\Temp\4635_1647765460_726.exeMD5
0dc969799cd07a91d7d00825bf6d7e9e
SHA1dd21e9900ca37dad0ce236aa636cf5a5554dda56
SHA25649424ea75f90474c09ff21f52d86bbbbb9577e420c553f4dd942ac555cec938a
SHA512570e42808e9a0fe378ceee70fcbd0a18d23df19d0834056ef502268d7ef331def99806f2ceb53234f91caf936d53fe2dbff48dd9e6e82e5a3e245b98b7ec3455
-
memory/2284-134-0x0000000002630000-0x0000000002690000-memory.dmpFilesize
384KB
-
memory/2284-135-0x0000000000400000-0x0000000000891000-memory.dmpFilesize
4.6MB
-
memory/2284-136-0x0000000000400000-0x0000000000891000-memory.dmpFilesize
4.6MB
-
memory/2612-148-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/2612-150-0x0000000005330000-0x000000000534E000-memory.dmpFilesize
120KB
-
memory/2612-145-0x0000000004EF0000-0x0000000004FFA000-memory.dmpFilesize
1.0MB
-
memory/2612-146-0x0000000004E20000-0x0000000004E5C000-memory.dmpFilesize
240KB
-
memory/2612-147-0x0000000005150000-0x00000000051C6000-memory.dmpFilesize
472KB
-
memory/2612-143-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/2612-149-0x0000000005F20000-0x00000000064C4000-memory.dmpFilesize
5.6MB
-
memory/2612-144-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/2612-151-0x0000000005DB0000-0x0000000005E16000-memory.dmpFilesize
408KB
-
memory/2612-152-0x0000000006A40000-0x0000000006C02000-memory.dmpFilesize
1.8MB
-
memory/2612-153-0x0000000007140000-0x000000000766C000-memory.dmpFilesize
5.2MB
-
memory/2612-154-0x00000000069D0000-0x0000000006A20000-memory.dmpFilesize
320KB
-
memory/2612-137-0x0000000000000000-mapping.dmp
-
memory/2612-138-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2788-155-0x0000000000000000-mapping.dmp