Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 07:49
Static task
static1
Behavioral task
behavioral1
Sample
7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe
Resource
win10-20220414-en
General
-
Target
7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe
-
Size
715KB
-
MD5
a97f4950c1a9e33c1a91c49cc28504b5
-
SHA1
5143a6a55d755f62491386b3af5e3f2e782f15a5
-
SHA256
7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57
-
SHA512
e47e1ec9c2f103b25a5d3d5b652d74cbe56176911aab025b99c5e58c229689cc1acc266d3b9b0c20f0982a2815d650e946ec3ecc415c6621208be15573938d35
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3684-137-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3684-142-0x000000000041AD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exedescription pid process target process PID 2300 set thread context of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4320 2300 WerFault.exe 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 3684 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3684 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exedescription pid process target process PID 2300 wrote to memory of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe PID 2300 wrote to memory of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe PID 2300 wrote to memory of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe PID 2300 wrote to memory of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe PID 2300 wrote to memory of 3684 2300 7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe"C:\Users\Admin\AppData\Local\Temp\7f7a2d15e339a696bcc070c361823f04f163059f9b261ad211e9d7aee5802d57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 3722⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2300-118-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-119-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-120-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-121-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-122-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-123-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-124-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-125-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-126-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-127-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-128-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-129-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-130-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-131-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-132-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-133-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-134-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-135-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2300-136-0x00000000008E9000-0x00000000008EE000-memory.dmpFilesize
20KB
-
memory/3684-137-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3684-142-0x000000000041AD5A-mapping.dmp
-
memory/3684-143-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-144-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-145-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-146-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-147-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-149-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-150-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-152-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-153-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-154-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-155-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-156-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-157-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-158-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-159-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-160-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-161-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-162-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-163-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-164-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-166-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-165-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-167-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-168-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-169-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-170-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-171-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-172-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-173-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-174-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-176-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-177-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-178-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-179-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-180-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-181-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-182-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-183-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-184-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-185-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/3684-198-0x0000000009330000-0x0000000009936000-memory.dmpFilesize
6.0MB
-
memory/3684-199-0x0000000008D80000-0x0000000008D92000-memory.dmpFilesize
72KB
-
memory/3684-200-0x0000000008EB0000-0x0000000008FBA000-memory.dmpFilesize
1.0MB
-
memory/3684-203-0x0000000008DE0000-0x0000000008E1E000-memory.dmpFilesize
248KB
-
memory/3684-205-0x0000000008E20000-0x0000000008E6B000-memory.dmpFilesize
300KB
-
memory/3684-214-0x0000000009160000-0x00000000091C6000-memory.dmpFilesize
408KB
-
memory/3684-222-0x0000000009CC0000-0x0000000009D36000-memory.dmpFilesize
472KB
-
memory/3684-223-0x0000000009DE0000-0x0000000009E72000-memory.dmpFilesize
584KB
-
memory/3684-224-0x000000000A380000-0x000000000A87E000-memory.dmpFilesize
5.0MB
-
memory/3684-228-0x000000000A080000-0x000000000A09E000-memory.dmpFilesize
120KB
-
memory/3684-235-0x000000000A880000-0x000000000AA42000-memory.dmpFilesize
1.8MB
-
memory/3684-236-0x000000000AF80000-0x000000000B4AC000-memory.dmpFilesize
5.2MB
-
memory/3684-332-0x000000000A260000-0x000000000A2B0000-memory.dmpFilesize
320KB