Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 04:48
Static task
static1
Behavioral task
behavioral1
Sample
8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe
Resource
win10-20220414-en
General
-
Target
8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe
-
Size
715KB
-
MD5
d7d955c598e1b803263a6ed4c8793ea6
-
SHA1
01f2fc8f6c56a28366156c747dc3d4d2d4ec2c0b
-
SHA256
8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46
-
SHA512
7b63461a65913211b41ce360df34289c26192f7ea46e01d3adf3f3adcf0ec42f0c78e8b974656fa79d6f254ed07d1f309dfe6b1e21c7549052018508fbad2bd2
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2652-138-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2652-143-0x000000000041AD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exedescription pid process target process PID 3068 set thread context of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1456 3068 WerFault.exe 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 2652 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2652 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exedescription pid process target process PID 3068 wrote to memory of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe PID 3068 wrote to memory of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe PID 3068 wrote to memory of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe PID 3068 wrote to memory of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe PID 3068 wrote to memory of 2652 3068 8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe"C:\Users\Admin\AppData\Local\Temp\8fac06e1ec79e09b27dc014e28d5782de936ad0fb598d2982c77355f26979e46.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 3802⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2652-180-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-174-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-498-0x000000000BEE0000-0x000000000C40C000-memory.dmpFilesize
5.2MB
-
memory/2652-497-0x000000000B7E0000-0x000000000B9A2000-memory.dmpFilesize
1.8MB
-
memory/2652-237-0x000000000A910000-0x000000000A960000-memory.dmpFilesize
320KB
-
memory/2652-162-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-223-0x00000000094E0000-0x00000000094FE000-memory.dmpFilesize
120KB
-
memory/2652-219-0x0000000009BC0000-0x0000000009C52000-memory.dmpFilesize
584KB
-
memory/2652-218-0x0000000009400000-0x0000000009476000-memory.dmpFilesize
472KB
-
memory/2652-215-0x000000000A0C0000-0x000000000A5BE000-memory.dmpFilesize
5.0MB
-
memory/2652-207-0x00000000090B0000-0x00000000090FB000-memory.dmpFilesize
300KB
-
memory/2652-205-0x0000000009070000-0x00000000090AE000-memory.dmpFilesize
248KB
-
memory/2652-202-0x0000000009140000-0x000000000924A000-memory.dmpFilesize
1.0MB
-
memory/2652-201-0x0000000009010000-0x0000000009022000-memory.dmpFilesize
72KB
-
memory/2652-200-0x00000000095B0000-0x0000000009BB6000-memory.dmpFilesize
6.0MB
-
memory/2652-161-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-187-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-186-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-185-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-138-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2652-143-0x000000000041AD5A-mapping.dmp
-
memory/2652-144-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-145-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-146-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-147-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-148-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-184-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-151-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-152-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-154-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-155-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-156-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-158-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-157-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-159-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-160-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-183-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-225-0x000000000A000000-0x000000000A066000-memory.dmpFilesize
408KB
-
memory/2652-182-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-164-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-165-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-167-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-166-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-168-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-169-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-170-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-171-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-172-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-173-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-163-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-175-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-176-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-178-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-179-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/2652-181-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-150-0x00000000001BA000-0x00000000001BC000-memory.dmpFilesize
8KB
-
memory/3068-123-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-129-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-131-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-137-0x00000000001BA000-0x00000000001BC000-memory.dmpFilesize
8KB
-
memory/3068-136-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-135-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-119-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-121-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-132-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-130-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-134-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-128-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-127-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-126-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-125-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-124-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-120-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-122-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB
-
memory/3068-133-0x0000000076FF0000-0x000000007717E000-memory.dmpFilesize
1.6MB