Analysis
-
max time kernel
55s -
max time network
75s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-06-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe
Resource
win10-20220414-en
General
-
Target
78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe
-
Size
745KB
-
MD5
4e42432eb9f22bbb32ffb678d83d28e8
-
SHA1
b82054919c96ecec758471d6b2de6078561c52bb
-
SHA256
78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913
-
SHA512
4a70fedcf8ddbaf5b54f16d55e4e284a8883a1a15c55a604efc1100c5d709a3a340253e2e8161fae7b24e62fdb16cb7e4c80aac0922b12ced6cd49aff98addf1
Malware Config
Extracted
redline
76
139.99.32.83:43199
-
auth_value
44d461325298129ed3c705440f57962c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1012-128-0x0000000000530000-0x0000000000550000-memory.dmp family_redline behavioral1/memory/1012-133-0x000000000054AD5A-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exedescription pid process target process PID 3936 set thread context of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2068 3936 WerFault.exe 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 1012 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1012 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exedescription pid process target process PID 3936 wrote to memory of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe PID 3936 wrote to memory of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe PID 3936 wrote to memory of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe PID 3936 wrote to memory of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe PID 3936 wrote to memory of 1012 3936 78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe"C:\Users\Admin\AppData\Local\Temp\78b27899e62b5910104d9c80b016736a3ae210b6be7e80daacf69b408ee9d913.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 2842⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1012-158-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-176-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-134-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-135-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-136-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-485-0x000000000B760000-0x000000000BC8C000-memory.dmpFilesize
5.2MB
-
memory/1012-484-0x000000000B060000-0x000000000B222000-memory.dmpFilesize
1.8MB
-
memory/1012-228-0x000000000A260000-0x000000000A2B0000-memory.dmpFilesize
320KB
-
memory/1012-157-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-219-0x000000000A000000-0x000000000A092000-memory.dmpFilesize
584KB
-
memory/1012-218-0x0000000009980000-0x00000000099F6000-memory.dmpFilesize
472KB
-
memory/1012-210-0x0000000008DA0000-0x0000000008E06000-memory.dmpFilesize
408KB
-
memory/1012-206-0x0000000009B00000-0x0000000009FFE000-memory.dmpFilesize
5.0MB
-
memory/1012-197-0x0000000008A60000-0x0000000008AAB000-memory.dmpFilesize
300KB
-
memory/1012-137-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-138-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-140-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-195-0x0000000008A20000-0x0000000008A5E000-memory.dmpFilesize
248KB
-
memory/1012-128-0x0000000000530000-0x0000000000550000-memory.dmpFilesize
128KB
-
memory/1012-191-0x0000000006660000-0x0000000006672000-memory.dmpFilesize
72KB
-
memory/1012-190-0x0000000008FF0000-0x00000000095F6000-memory.dmpFilesize
6.0MB
-
memory/1012-182-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-181-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-142-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-144-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-145-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-146-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-147-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-148-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-149-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-150-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-151-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-152-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-154-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-153-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-155-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-169-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-223-0x000000000A1C0000-0x000000000A1DE000-memory.dmpFilesize
120KB
-
memory/1012-192-0x0000000008AF0000-0x0000000008BFA000-memory.dmpFilesize
1.0MB
-
memory/1012-159-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-160-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-161-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-162-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-163-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-164-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-165-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-166-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-168-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-156-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-170-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-171-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-172-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-173-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-174-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-175-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-133-0x000000000054AD5A-mapping.dmp
-
memory/1012-177-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-178-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-179-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/1012-180-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-125-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-121-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-126-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-120-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-141-0x0000000000600000-0x00000000006AE000-memory.dmpFilesize
696KB
-
memory/3936-123-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-205-0x0000000000600000-0x00000000006AE000-memory.dmpFilesize
696KB
-
memory/3936-127-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-124-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-122-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-119-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-118-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-117-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-116-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-115-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3936-114-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB