Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-06-2022 07:34
Static task
static1
Behavioral task
behavioral1
Sample
a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe
Resource
win10v2004-20220414-en
General
-
Target
a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe
-
Size
290KB
-
MD5
98422ed16c0986e96b8628b55e1e86a6
-
SHA1
c5888f1c5474e77f625903d7247239e5fc362a18
-
SHA256
a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3
-
SHA512
fadf6f67fa71ad7df3d989b59b6bcd092b0e4e2ae6749b8641caf7a3d7b41796c141490fdfa534f9dfaf5a6727d31b9d66dbbe7a75f4e0dc1b734371061df2b8
Malware Config
Extracted
redline
9-5
139.99.32.83:43199
-
auth_value
637de2b47f42d9cc7912f71cb6b57b5b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3340-131-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exedescription pid process target process PID 2304 set thread context of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2204 2304 WerFault.exe a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 3340 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3340 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exedescription pid process target process PID 2304 wrote to memory of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe PID 2304 wrote to memory of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe PID 2304 wrote to memory of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe PID 2304 wrote to memory of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe PID 2304 wrote to memory of 3340 2304 a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe"C:\Users\Admin\AppData\Local\Temp\a8ed64c2ba2355ae29d0f0d8fff78a40b8488fd60351839c6ce2347e355a74c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 2962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2304 -ip 23041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2304-136-0x0000000000F7C000-0x0000000000F7E000-memory.dmpFilesize
8KB
-
memory/3340-140-0x0000000007E30000-0x0000000007E6C000-memory.dmpFilesize
240KB
-
memory/3340-142-0x0000000008B60000-0x0000000008BF2000-memory.dmpFilesize
584KB
-
memory/3340-137-0x0000000006550000-0x0000000006B68000-memory.dmpFilesize
6.1MB
-
memory/3340-138-0x0000000007DD0000-0x0000000007DE2000-memory.dmpFilesize
72KB
-
memory/3340-139-0x0000000007F00000-0x000000000800A000-memory.dmpFilesize
1.0MB
-
memory/3340-130-0x0000000000000000-mapping.dmp
-
memory/3340-141-0x0000000008A40000-0x0000000008AB6000-memory.dmpFilesize
472KB
-
memory/3340-131-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3340-143-0x00000000091B0000-0x0000000009754000-memory.dmpFilesize
5.6MB
-
memory/3340-144-0x0000000008AC0000-0x0000000008ADE000-memory.dmpFilesize
120KB
-
memory/3340-145-0x0000000008EA0000-0x0000000008F06000-memory.dmpFilesize
408KB
-
memory/3340-146-0x0000000009930000-0x0000000009AF2000-memory.dmpFilesize
1.8MB
-
memory/3340-147-0x000000000A030000-0x000000000A55C000-memory.dmpFilesize
5.2MB
-
memory/3340-148-0x0000000009100000-0x0000000009150000-memory.dmpFilesize
320KB