Analysis
- max time kernel
168s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 18:04
General
- Target fbc6dcddde1fa8598a4c10a72e389863.exe
- Size 540KB
- Sample220520-wnk5labdg2
- SHA256 3160f8d7ba9b3b64ba2ee22b70e1bb3521c84278d89d30dde7354fb56f20c1d3
Malware Config
Extracted
-
redline
-
ruz
-
91.211.251.186:41933
-
auth_value
b5178f81ea8830c13e88c402dccf09f0
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbc6dcddde1fa8598a4c10a72e389863.exe"C:\Users\Admin\AppData\Local\Temp\fbc6dcddde1fa8598a4c10a72e389863.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3128-131-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3128-136-0x0000000005DE0000-0x00000000063F8000-memory.dmp
memory/3128-137-0x0000000005820000-0x0000000005832000-memory.dmp
memory/3128-138-0x0000000005950000-0x0000000005A5A000-memory.dmp
memory/3128-139-0x0000000005880000-0x00000000058BC000-memory.dmp
memory/3128-140-0x00000000069B0000-0x0000000006F54000-memory.dmp
memory/3128-141-0x0000000005D00000-0x0000000005D92000-memory.dmp
memory/3128-142-0x0000000006400000-0x0000000006476000-memory.dmp
memory/3128-143-0x00000000064C0000-0x00000000064DE000-memory.dmp
memory/3128-144-0x0000000006840000-0x00000000068A6000-memory.dmp
memory/3128-145-0x0000000007450000-0x00000000074A0000-memory.dmp
memory/3128-146-0x0000000008240000-0x0000000008402000-memory.dmp
memory/3128-147-0x0000000008940000-0x0000000008E6C000-memory.dmp