Analysis
- max time kernel
90s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
22/05/2022, 14:26
General
- Target bb46fb813b1a0a9429642cdcf8a41e56e5b893339a3cb.exe
- Size 764KB
- Sample220522-rrt5fsdghn
- SHA256 bb46fb813b1a0a9429642cdcf8a41e56e5b893339a3cb550acdf322acb3399e4
Malware Config
Extracted
-
redline
-
install1
-
185.215.113.74:21098
-
auth_value
8579b4a1b6885c111972efbd7ab699d4
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb46fb813b1a0a9429642cdcf8a41e56e5b893339a3cb.exe"C:\Users\Admin\AppData\Local\Temp\bb46fb813b1a0a9429642cdcf8a41e56e5b893339a3cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3476-130-0x0000000000C90000-0x0000000000D54000-memory.dmp
memory/5112-132-0x0000000000400000-0x0000000000420000-memory.dmp
memory/5112-133-0x0000000005570000-0x0000000005B88000-memory.dmp
memory/5112-134-0x0000000005010000-0x0000000005022000-memory.dmp
memory/5112-135-0x0000000005140000-0x000000000524A000-memory.dmp
memory/5112-136-0x0000000005070000-0x00000000050AC000-memory.dmp
memory/5112-137-0x00000000053F0000-0x0000000005466000-memory.dmp
memory/5112-138-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/5112-139-0x00000000061E0000-0x0000000006784000-memory.dmp
memory/5112-140-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
memory/5112-141-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/5112-142-0x0000000006C60000-0x0000000006E22000-memory.dmp
memory/5112-143-0x0000000007360000-0x000000000788C000-memory.dmp