Analysis
-
max time kernel
87s -
max time network
156s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 05:31
Static task
static1
Behavioral task
behavioral1
Sample
58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe
Resource
win10-20220414-en
General
-
Target
58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe
-
Size
715KB
-
MD5
1a8ad783d2485e78cd1142ee0fc1a89e
-
SHA1
8882e258d990713ed60f92153aba6b1775f8da46
-
SHA256
58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0
-
SHA512
b5f664d51e45f9edcf571803a63d6423ba1117853155d16566c3db951c62b96129fccc4f6617fd2bdad8a15d9484a83c7d47f924d3677273e0497526dc5e8777
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3368-138-0x00000000003D0000-0x00000000003F0000-memory.dmp family_redline behavioral1/memory/3368-143-0x00000000003EAD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exedescription pid process target process PID 3152 set thread context of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3580 3152 WerFault.exe 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 3368 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3368 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exedescription pid process target process PID 3152 wrote to memory of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe PID 3152 wrote to memory of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe PID 3152 wrote to memory of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe PID 3152 wrote to memory of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe PID 3152 wrote to memory of 3368 3152 58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe"C:\Users\Admin\AppData\Local\Temp\58af78b464503e903769374ec830f15b581625f296f474ab60db75a44ddd5ee0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 3922⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3152-119-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-120-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-121-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-122-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-123-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-124-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-125-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-126-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-127-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-128-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-129-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-130-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-131-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-132-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-133-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-134-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-135-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-136-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3152-137-0x0000000001455000-0x000000000145A000-memory.dmpFilesize
20KB
-
memory/3368-138-0x00000000003D0000-0x00000000003F0000-memory.dmpFilesize
128KB
-
memory/3368-143-0x00000000003EAD5A-mapping.dmp
-
memory/3368-144-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-145-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-146-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-147-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-148-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-150-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-151-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-153-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-154-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-155-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-156-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-157-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-158-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-159-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-160-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-161-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-162-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-165-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-164-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-166-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-167-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-163-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-168-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-169-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-170-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-171-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-172-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-173-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-174-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-175-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-177-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-178-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-179-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-180-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-181-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-182-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-183-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-184-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-185-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-186-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3368-199-0x0000000009040000-0x0000000009646000-memory.dmpFilesize
6.0MB
-
memory/3368-200-0x0000000008A50000-0x0000000008A62000-memory.dmpFilesize
72KB
-
memory/3368-201-0x0000000008B80000-0x0000000008C8A000-memory.dmpFilesize
1.0MB
-
memory/3368-204-0x0000000008AB0000-0x0000000008AEE000-memory.dmpFilesize
248KB
-
memory/3368-206-0x0000000008B20000-0x0000000008B6B000-memory.dmpFilesize
300KB
-
memory/3368-215-0x0000000008DF0000-0x0000000008E56000-memory.dmpFilesize
408KB
-
memory/3368-223-0x0000000009950000-0x00000000099C6000-memory.dmpFilesize
472KB
-
memory/3368-224-0x0000000009AA0000-0x0000000009B32000-memory.dmpFilesize
584KB
-
memory/3368-225-0x000000000A040000-0x000000000A53E000-memory.dmpFilesize
5.0MB
-
memory/3368-229-0x0000000009A80000-0x0000000009A9E000-memory.dmpFilesize
120KB
-
memory/3368-236-0x000000000A710000-0x000000000A8D2000-memory.dmpFilesize
1.8MB
-
memory/3368-237-0x000000000AE10000-0x000000000B33C000-memory.dmpFilesize
5.2MB
-
memory/3368-329-0x0000000009F80000-0x0000000009FD0000-memory.dmpFilesize
320KB