Analysis
-
max time kernel
110s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-06-2022 15:32
Static task
static1
Behavioral task
behavioral1
Sample
78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe
Resource
win10v2004-20220414-en
General
-
Target
78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe
-
Size
290KB
-
MD5
a268805ffcc0978922cbb3d250e16525
-
SHA1
d16ac00d687f608e76cde95f87473c91b58679e0
-
SHA256
78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0
-
SHA512
1163e1b1d69877cc6b43412269fdada33fd36dd94e461c2dc61f1a9046bd78c7da3d3b89964cc2332f47054256696bc295fcce9c67c4de1b41906d5555e4f75e
Malware Config
Extracted
redline
9-5
139.99.32.83:43199
-
auth_value
637de2b47f42d9cc7912f71cb6b57b5b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-131-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exedescription pid process target process PID 4892 set thread context of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1604 4892 WerFault.exe 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 1344 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1344 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exedescription pid process target process PID 4892 wrote to memory of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe PID 4892 wrote to memory of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe PID 4892 wrote to memory of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe PID 4892 wrote to memory of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe PID 4892 wrote to memory of 1344 4892 78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe"C:\Users\Admin\AppData\Local\Temp\78ac30db2617db407a39162d8bf963705cbffa575648b65ddeb26ff9431243e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 3082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 48921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-140-0x0000000007A70000-0x0000000007AAC000-memory.dmpFilesize
240KB
-
memory/1344-142-0x0000000005A20000-0x0000000005AB2000-memory.dmpFilesize
584KB
-
memory/1344-148-0x0000000008FE0000-0x000000000950C000-memory.dmpFilesize
5.2MB
-
memory/1344-137-0x0000000006100000-0x0000000006718000-memory.dmpFilesize
6.1MB
-
memory/1344-138-0x0000000005FC0000-0x0000000005FD2000-memory.dmpFilesize
72KB
-
memory/1344-139-0x0000000007B80000-0x0000000007C8A000-memory.dmpFilesize
1.0MB
-
memory/1344-131-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1344-141-0x00000000059A0000-0x0000000005A16000-memory.dmpFilesize
472KB
-
memory/1344-130-0x0000000000000000-mapping.dmp
-
memory/1344-143-0x0000000008500000-0x0000000008AA4000-memory.dmpFilesize
5.6MB
-
memory/1344-144-0x0000000007CD0000-0x0000000007CEE000-memory.dmpFilesize
120KB
-
memory/1344-145-0x0000000007F90000-0x0000000007FF6000-memory.dmpFilesize
408KB
-
memory/1344-146-0x0000000008050000-0x00000000080A0000-memory.dmpFilesize
320KB
-
memory/1344-147-0x0000000008270000-0x0000000008432000-memory.dmpFilesize
1.8MB
-
memory/4892-136-0x000000000102B000-0x000000000102D000-memory.dmpFilesize
8KB