Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
23/03/2022, 04:51
General
- Target 68775806.exe
- Size 557KB
- Sample220323-fgvgpabhep
- SHA256 5d913dfaea341540468e089d54d3a903f95c3e177db7a4f8a96c91ae8e2bde9a
Malware Config
Extracted
-
redline
-
@Black_Santa21
-
188.68.205.115:17645
-
auth_value
b0e4dc9dc5b79e2d3c26a88ccdb8c0f8
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68775806.exe"C:\Users\Admin\AppData\Local\Temp\68775806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3632-142-0x0000000005CD0000-0x0000000006274000-memory.dmp
memory/3632-143-0x0000000005020000-0x00000000050B2000-memory.dmp
memory/3632-149-0x0000000006D50000-0x0000000006DA0000-memory.dmp
memory/3632-133-0x0000000000580000-0x00000000005A0000-memory.dmp
memory/3632-138-0x0000000005100000-0x0000000005718000-memory.dmp
memory/3632-139-0x0000000004B50000-0x0000000004B62000-memory.dmp
memory/3632-148-0x0000000006DA0000-0x00000000072CC000-memory.dmp
memory/3632-140-0x0000000004C80000-0x0000000004D8A000-memory.dmp
memory/3632-141-0x0000000004BB0000-0x0000000004BEC000-memory.dmp
memory/3632-144-0x0000000005720000-0x0000000005786000-memory.dmp
memory/3632-145-0x0000000005B50000-0x0000000005BC6000-memory.dmp
memory/3632-146-0x0000000005CA0000-0x0000000005CBE000-memory.dmp
memory/3632-147-0x00000000066A0000-0x0000000006862000-memory.dmp
memory/4712-132-0x0000000003430000-0x0000000003433000-memory.dmp
memory/4712-131-0x0000000002340000-0x00000000023A0000-memory.dmp