Analysis
- max time kernel
179s - max time network
191s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
24/03/2022, 21:29
General
- Target 98effa147916ddfa55103f6d439fb5c7.exe
- Size 614KB
- Sample220324-1bw4jsbchm
- SHA256 eb3069a13ee9020b0bf6675bdb70c92e67c5b7eeb17f882df4c7f2629047ff02
Malware Config
Extracted
-
redline
-
62.204.41.141:24758
-
auth_value
5ac602c152cb8163381bbfa626204215
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98effa147916ddfa55103f6d439fb5c7.exe"C:\Users\Admin\AppData\Local\Temp\98effa147916ddfa55103f6d439fb5c7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1492-142-0x00000000087E0000-0x0000000008856000-memory.dmp
memory/1492-143-0x0000000008900000-0x0000000008992000-memory.dmp
memory/1492-133-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1492-138-0x0000000006330000-0x0000000006948000-memory.dmp
memory/1492-139-0x00000000062E0000-0x00000000062F2000-memory.dmp
memory/1492-149-0x00000000057C0000-0x0000000005810000-memory.dmp
memory/1492-140-0x0000000007CC0000-0x0000000007DCA000-memory.dmp
memory/1492-148-0x000000000AC40000-0x000000000B16C000-memory.dmp
memory/1492-141-0x0000000007BF0000-0x0000000007C2C000-memory.dmp
memory/1492-144-0x0000000008F50000-0x00000000094F4000-memory.dmp
memory/1492-145-0x0000000008880000-0x000000000889E000-memory.dmp
memory/1492-146-0x0000000008C70000-0x0000000008CD6000-memory.dmp
memory/1492-147-0x0000000007FA0000-0x0000000008162000-memory.dmp
memory/2232-131-0x0000000003450000-0x0000000003453000-memory.dmp
memory/2232-130-0x0000000002320000-0x0000000002380000-memory.dmp