Analysis
- max time kernel
186s - max time network
199s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
11/05/2022, 01:22
General
- Target 38299ac520e112d4d31ca74b5b9a7f89.exe
- Size 1.8MB
- Sample220511-bq8nfsehem
- SHA256 8e69124eef60e3fd34df9b53b91c526e8c4b120d0e56bf8565080362f767284f
Malware Config
Extracted
-
redline
-
95.217.225.59:40037
-
auth_value
d93fac74f659041e521308e32603f62c
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Downloads MZ/PE file
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38299ac520e112d4d31ca74b5b9a7f89.exe"C:\Users\Admin\AppData\Local\Temp\38299ac520e112d4d31ca74b5b9a7f89.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/492-130-0x00000000000E0000-0x00000000002B0000-memory.dmp
memory/492-131-0x00000000000E0000-0x00000000002B0000-memory.dmp
memory/1548-133-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1548-138-0x0000000005E90000-0x00000000064A8000-memory.dmp
memory/1548-139-0x00000000058F0000-0x0000000005902000-memory.dmp
memory/1548-140-0x0000000005A20000-0x0000000005B2A000-memory.dmp
memory/1548-141-0x0000000005950000-0x000000000598C000-memory.dmp
memory/1548-142-0x0000000006B60000-0x0000000007104000-memory.dmp
memory/1548-143-0x00000000065B0000-0x0000000006642000-memory.dmp
memory/1548-144-0x0000000006650000-0x00000000066C6000-memory.dmp
memory/1548-145-0x0000000006730000-0x000000000674E000-memory.dmp
memory/1548-146-0x0000000007180000-0x00000000071E6000-memory.dmp
memory/1548-147-0x00000000072F0000-0x0000000007340000-memory.dmp
memory/1548-148-0x0000000007D30000-0x0000000007EF2000-memory.dmp
memory/1548-149-0x0000000008430000-0x000000000895C000-memory.dmp