Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe
Resource
win10v2004-20220414-en
General
-
Target
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe
-
Size
3.6MB
-
MD5
34a6cfdf1745cec12dfbbf98c3b9f9e5
-
SHA1
11727439dc908ac568b280e9ce83a0abe013df20
-
SHA256
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5
-
SHA512
5e021c59b6aba8029ba22fffcd947502b1901759501338f5b806b35928fd29b5d780121ed923cd209eb8ad4b950d11a134566b9c647d3c6f8a25e95b84138437
Malware Config
Extracted
redline
test1
disandillanne.xyz:80
-
auth_value
49b58bceac3797b6c21fd0772031e010
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-60-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1960-66-0x00000000004191AE-mapping.dmp family_redline behavioral1/memory/1960-67-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1960-69-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exedescription pid process target process PID 1964 set thread context of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exedescription pid process target process PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe PID 1964 wrote to memory of 1960 1964 118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe"C:\Users\Admin\AppData\Local\Temp\118e8f3dd722b00bde8571f3b84cb278c21517e2c97e2795783b55263f44f1b5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1960-79-0x0000000074090000-0x00000000740B0000-memory.dmpFilesize
128KB
-
memory/1960-80-0x000000006D730000-0x000000006DE6E000-memory.dmpFilesize
7.2MB
-
memory/1960-74-0x00000000742F0000-0x00000000746E3000-memory.dmpFilesize
3.9MB
-
memory/1960-75-0x0000000070C60000-0x000000007180E000-memory.dmpFilesize
11.7MB
-
memory/1960-73-0x0000000071810000-0x0000000071FF0000-memory.dmpFilesize
7.9MB
-
memory/1960-66-0x00000000004191AE-mapping.dmp
-
memory/1960-85-0x0000000071FF0000-0x0000000072A00000-memory.dmpFilesize
10.1MB
-
memory/1960-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1960-69-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1960-70-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/1960-71-0x0000000072A00000-0x0000000073D8F000-memory.dmpFilesize
19.6MB
-
memory/1960-72-0x0000000071FF0000-0x0000000072A00000-memory.dmpFilesize
10.1MB
-
memory/1960-86-0x000000006E420000-0x000000006F72F000-memory.dmpFilesize
19.1MB
-
memory/1960-84-0x0000000072A00000-0x0000000073D8F000-memory.dmpFilesize
19.6MB
-
memory/1960-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1960-76-0x000000006F950000-0x0000000070C57000-memory.dmpFilesize
19.0MB
-
memory/1960-77-0x000000006E130000-0x000000006E418000-memory.dmpFilesize
2.9MB
-
memory/1960-78-0x000000006DE70000-0x000000006E12B000-memory.dmpFilesize
2.7MB
-
memory/1960-83-0x000000006E420000-0x000000006F72F000-memory.dmpFilesize
19.1MB
-
memory/1960-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1960-81-0x000000006D660000-0x000000006D729000-memory.dmpFilesize
804KB
-
memory/1960-82-0x000000006D560000-0x000000006D65C000-memory.dmpFilesize
1008KB
-
memory/1964-54-0x0000000000400000-0x00000000009E8000-memory.dmpFilesize
5.9MB
-
memory/1964-59-0x0000000000400000-0x00000000009E8000-memory.dmpFilesize
5.9MB
-
memory/1964-68-0x0000000000400000-0x00000000009E8000-memory.dmpFilesize
5.9MB
-
memory/1964-61-0x0000000000320000-0x0000000000380000-memory.dmpFilesize
384KB