Analysis
-
max time kernel
56s -
max time network
85s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe
Resource
win10-20220414-en
General
-
Target
6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe
-
Size
715KB
-
MD5
30b37f22e8096b74d92dde05607f6927
-
SHA1
d60df3b83fafadbc674fe92c9d4fc6882c39ea21
-
SHA256
6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7
-
SHA512
84b56845735bd480f5f80213310bcf362ca142e34a67b0d232d885280f741cc9d04822d562579e8334c7e80a0abbd889886424cf281980b220b39d881a0c1f15
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4684-133-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/4684-138-0x000000000041AD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exedescription pid process target process PID 4588 set thread context of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5072 4588 WerFault.exe 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 4684 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4684 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exedescription pid process target process PID 4588 wrote to memory of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe PID 4588 wrote to memory of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe PID 4588 wrote to memory of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe PID 4588 wrote to memory of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe PID 4588 wrote to memory of 4684 4588 6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe"C:\Users\Admin\AppData\Local\Temp\6d365fb843e6951544c8882513f838eed3625dba77722863c864e62fc9646fe7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 3802⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4588-114-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-115-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-116-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-117-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-118-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-119-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-120-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-121-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-122-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-123-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-124-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-125-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-126-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-127-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-128-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-129-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-130-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-131-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4588-132-0x000000000109A000-0x000000000109F000-memory.dmpFilesize
20KB
-
memory/4588-144-0x000000000109C000-0x000000000109E000-memory.dmpFilesize
8KB
-
memory/4684-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4684-138-0x000000000041AD5A-mapping.dmp
-
memory/4684-139-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-140-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-141-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-142-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-143-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-146-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-147-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-149-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-150-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-151-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-153-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-152-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-154-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-155-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-156-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-157-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-159-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-158-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-160-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-161-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-162-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-163-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-164-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-165-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-166-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-167-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-168-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-169-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-170-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-171-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-173-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-174-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-175-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-176-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-177-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-178-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-179-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-180-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-181-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-182-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4684-195-0x0000000009430000-0x0000000009A36000-memory.dmpFilesize
6.0MB
-
memory/4684-196-0x0000000008E50000-0x0000000008E62000-memory.dmpFilesize
72KB
-
memory/4684-197-0x0000000008F80000-0x000000000908A000-memory.dmpFilesize
1.0MB
-
memory/4684-200-0x0000000008EB0000-0x0000000008EEE000-memory.dmpFilesize
248KB
-
memory/4684-202-0x0000000008F00000-0x0000000008F4B000-memory.dmpFilesize
300KB
-
memory/4684-211-0x00000000091F0000-0x0000000009256000-memory.dmpFilesize
408KB
-
memory/4684-219-0x000000000A240000-0x000000000A73E000-memory.dmpFilesize
5.0MB
-
memory/4684-222-0x0000000009DC0000-0x0000000009E36000-memory.dmpFilesize
472KB
-
memory/4684-223-0x0000000009EE0000-0x0000000009F72000-memory.dmpFilesize
584KB
-
memory/4684-227-0x0000000009EA0000-0x0000000009EBE000-memory.dmpFilesize
120KB
-
memory/4684-228-0x000000000A0F0000-0x000000000A140000-memory.dmpFilesize
320KB
-
memory/4684-237-0x000000000AA10000-0x000000000ABD2000-memory.dmpFilesize
1.8MB
-
memory/4684-238-0x000000000B110000-0x000000000B63C000-memory.dmpFilesize
5.2MB