Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-06-2022 02:24
Static task
static1
Behavioral task
behavioral1
Sample
c1c1278e20d3873a088dbe56dc1f59f3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c1c1278e20d3873a088dbe56dc1f59f3.exe
Resource
win10v2004-20220414-en
General
-
Target
c1c1278e20d3873a088dbe56dc1f59f3.exe
-
Size
299KB
-
MD5
c1c1278e20d3873a088dbe56dc1f59f3
-
SHA1
b23531bf87624a717183756de5954cb059fd3df1
-
SHA256
c6ebefab2e87ee95b7bd9946bd7bf35ef367e0a8e6dcbc3722b7f7984a5ec272
-
SHA512
6756218a1618c14e040060075fcf52b15349b83fb7acddf2b304fd1fc2c023e957265d206e45cb46ce1082002fa9fef6ed5ba2460bfa50278e7598fe19f071c0
Malware Config
Extracted
redline
1
65.108.5.252:43673
-
auth_value
95517c2a2f56575288c35d9dfde4a6aa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3272-131-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/2184-136-0x00000000002C0000-0x000000000030A000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c1c1278e20d3873a088dbe56dc1f59f3.exedescription pid process target process PID 2184 set thread context of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c1c1278e20d3873a088dbe56dc1f59f3.exedescription pid process target process PID 2184 wrote to memory of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe PID 2184 wrote to memory of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe PID 2184 wrote to memory of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe PID 2184 wrote to memory of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe PID 2184 wrote to memory of 3272 2184 c1c1278e20d3873a088dbe56dc1f59f3.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1c1278e20d3873a088dbe56dc1f59f3.exe"C:\Users\Admin\AppData\Local\Temp\c1c1278e20d3873a088dbe56dc1f59f3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2184-136-0x00000000002C0000-0x000000000030A000-memory.dmpFilesize
296KB
-
memory/3272-130-0x0000000000000000-mapping.dmp
-
memory/3272-131-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3272-137-0x0000000005630000-0x0000000005C48000-memory.dmpFilesize
6.1MB
-
memory/3272-138-0x00000000050D0000-0x00000000050E2000-memory.dmpFilesize
72KB
-
memory/3272-139-0x0000000005200000-0x000000000530A000-memory.dmpFilesize
1.0MB
-
memory/3272-140-0x0000000005130000-0x000000000516C000-memory.dmpFilesize
240KB