Analysis
-
max time kernel
52s -
max time network
146s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 08:16
Static task
static1
Behavioral task
behavioral1
Sample
62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe
Resource
win10-20220414-en
General
-
Target
62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe
-
Size
715KB
-
MD5
3b6d8af290d0c23114dd6a3da8e40236
-
SHA1
9aedf1b20530fb81a616755debf7355e9209719a
-
SHA256
62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4
-
SHA512
29bf4601297f541704aa8925abbcf249cb78dce9e48b7d3551301178e5b7c4af97654d0ce3dd216198fcb3d8b656153ec62bdf3c2b0ae466d60f850e6478c892
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4748-132-0x0000000004330000-0x0000000004350000-memory.dmp family_redline behavioral1/memory/4748-137-0x000000000434AD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exedescription pid process target process PID 3896 set thread context of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5112 3896 WerFault.exe 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 4748 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4748 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exedescription pid process target process PID 3896 wrote to memory of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe PID 3896 wrote to memory of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe PID 3896 wrote to memory of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe PID 3896 wrote to memory of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe PID 3896 wrote to memory of 4748 3896 62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe"C:\Users\Admin\AppData\Local\Temp\62bc8ea3db3cff80d57cfc3b6a822bbda1b427d0a645843c7480c20e56417af4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 3762⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3896-114-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-115-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-116-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-117-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-118-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-119-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-120-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-121-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-122-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-123-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-124-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-125-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-126-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-128-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-127-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-129-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-130-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/3896-131-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-132-0x0000000004330000-0x0000000004350000-memory.dmpFilesize
128KB
-
memory/4748-137-0x000000000434AD5A-mapping.dmp
-
memory/4748-138-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-139-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-140-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-141-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-142-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-144-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-145-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-147-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-148-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-149-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-150-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-151-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-152-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-153-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-154-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-155-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-156-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-157-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-158-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-159-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-160-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-161-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-163-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-162-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-164-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-165-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-166-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-167-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-168-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-169-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-171-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-172-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-173-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-174-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-175-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-176-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-177-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-178-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-179-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-180-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-181-0x0000000077160000-0x00000000772EE000-memory.dmpFilesize
1.6MB
-
memory/4748-193-0x0000000008FA0000-0x00000000095A6000-memory.dmpFilesize
6.0MB
-
memory/4748-194-0x0000000008990000-0x00000000089A2000-memory.dmpFilesize
72KB
-
memory/4748-195-0x0000000008AC0000-0x0000000008BCA000-memory.dmpFilesize
1.0MB
-
memory/4748-198-0x00000000089F0000-0x0000000008A2E000-memory.dmpFilesize
248KB
-
memory/4748-200-0x0000000008A30000-0x0000000008A7B000-memory.dmpFilesize
300KB
-
memory/4748-208-0x0000000008D50000-0x0000000008DC6000-memory.dmpFilesize
472KB
-
memory/4748-209-0x0000000008E70000-0x0000000008F02000-memory.dmpFilesize
584KB
-
memory/4748-210-0x0000000009AB0000-0x0000000009FAE000-memory.dmpFilesize
5.0MB
-
memory/4748-214-0x0000000008E50000-0x0000000008E6E000-memory.dmpFilesize
120KB
-
memory/4748-216-0x0000000009990000-0x00000000099F6000-memory.dmpFilesize
408KB
-
memory/4748-238-0x000000000A580000-0x000000000A742000-memory.dmpFilesize
1.8MB
-
memory/4748-239-0x000000000AC80000-0x000000000B1AC000-memory.dmpFilesize
5.2MB
-
memory/4748-578-0x000000000A7B0000-0x000000000A800000-memory.dmpFilesize
320KB