Overview
overview
10Static
static
SkyBlade/M...tle.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...rap.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...ter.js
windows10-2004_x64
1SkyBlade/M...x.html
windows10-2004_x64
1SkyBlade/M...dex.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...nav.js
windows10-2004_x64
1SkyBlade/M...e.html
windows10-2004_x64
1SkyBlade/M...o.html
windows10-2004_x64
1SkyBlade/M...b.html
windows10-2004_x64
1SkyBlade/M...s.html
windows10-2004_x64
1SkyBlade/M...a.html
windows10-2004_x64
1SkyBlade/M...e.html
windows10-2004_x64
1SkyBlade/M...m.html
windows10-2004_x64
1SkyBlade/M...t.html
windows10-2004_x64
1SkyBlade/S...me.exe
windows10-2004_x64
10Analysis
-
max time kernel
167s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
24-03-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
SkyBlade/ModTools/CastleDB/castle.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral2
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap-select.min.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral4
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.min.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral5
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/highlighter.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral6
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral8
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/jquery-1.9.1.min.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral9
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/nav.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral10
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/ExitNode.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelInfo.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral12
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelMob.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelProps.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral14
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Meta.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/RoomNode.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral16
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/SeededRandom.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Struct.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral18
Sample
SkyBlade/StartGame.exe
Resource
win10v2004-20220310-en
General
-
Target
SkyBlade/StartGame.exe
-
Size
635KB
-
MD5
314c4df9143ade6211cabd4cc24782c5
-
SHA1
240229f2b1aa44bf50e6c14ba7f990373a1ead3e
-
SHA256
84377b2b4b6f40c40f6dd585bebc2190d1a0bd1d63ff67c951a714b840cef287
-
SHA512
69fd8881f188e3a89320649be87de6a465d43e90dd5c913ce602cbac42b3a31213718f63aaed612e1f55fcc0e14f8dadc2439c0ce0beaabf77b4ed55d3942e7b
Malware Config
Extracted
redline
1
95.217.197.197:11343
-
auth_value
95517c2a2f56575288c35d9dfde4a6aa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral18/memory/552-137-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
StartGame.exedescription pid process target process PID 4176 set thread context of 552 4176 StartGame.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
StartGame.exedescription pid process target process PID 4176 wrote to memory of 552 4176 StartGame.exe AppLaunch.exe PID 4176 wrote to memory of 552 4176 StartGame.exe AppLaunch.exe PID 4176 wrote to memory of 552 4176 StartGame.exe AppLaunch.exe PID 4176 wrote to memory of 552 4176 StartGame.exe AppLaunch.exe PID 4176 wrote to memory of 552 4176 StartGame.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SkyBlade\StartGame.exe"C:\Users\Admin\AppData\Local\Temp\SkyBlade\StartGame.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-136-0x0000000000000000-mapping.dmp
-
memory/552-137-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/552-142-0x0000000005B00000-0x0000000006118000-memory.dmpFilesize
6.1MB
-
memory/552-143-0x00000000055A0000-0x00000000055B2000-memory.dmpFilesize
72KB
-
memory/552-144-0x00000000056D0000-0x00000000057DA000-memory.dmpFilesize
1.0MB
-
memory/552-145-0x0000000005600000-0x000000000563C000-memory.dmpFilesize
240KB
-
memory/4176-134-0x0000000002330000-0x0000000002390000-memory.dmpFilesize
384KB
-
memory/4176-135-0x0000000003450000-0x0000000003453000-memory.dmpFilesize
12KB