Analysis
-
max time kernel
60s -
max time network
69s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
28-06-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe
Resource
win10-20220414-en
General
-
Target
6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe
-
Size
3.9MB
-
MD5
7f83e72053c6fdfa5e9a9da2085222cc
-
SHA1
56839deb07dfd04336df5a2b45fd83c9d8e294ff
-
SHA256
6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a
-
SHA512
9dea0b95ea475b4d1ec8f34f42646b9f168ae7bc6871f6acb515eb551ef21d0efe73d9d1f0519dab9f99ac75fd02f05576c4c3210cedb2a1e144d3cdd9a678d6
Malware Config
Extracted
redline
test1
135.181.156.128:10944
-
auth_value
5e53df8b6dd563acc136377edcacc242
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/36716-129-0x0000000000430000-0x0000000000450000-memory.dmp family_redline behavioral1/memory/36716-134-0x000000000044AD82-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exedescription pid process target process PID 2844 set thread context of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 36828 2844 WerFault.exe 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 36716 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 36716 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exedescription pid process target process PID 2844 wrote to memory of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe PID 2844 wrote to memory of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe PID 2844 wrote to memory of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe PID 2844 wrote to memory of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe PID 2844 wrote to memory of 36716 2844 6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe"C:\Users\Admin\AppData\Local\Temp\6e6c4215c2e2b395f41e7c3a9605e1af2e9b8814af3e4beda4e76eded3988d8a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 672482⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2844-117-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-119-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-118-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-120-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-122-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-121-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-123-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-124-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2844-125-0x0000000000400000-0x0000000000A95000-memory.dmpFilesize
6.6MB
-
memory/36716-129-0x0000000000430000-0x0000000000450000-memory.dmpFilesize
128KB
-
memory/36716-134-0x000000000044AD82-mapping.dmp
-
memory/36716-135-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-136-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-138-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-137-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-139-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-141-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-142-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-145-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-144-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-146-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-147-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-148-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-149-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-150-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-151-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-152-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-153-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-155-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-154-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-156-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-157-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-158-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-159-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-160-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-162-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-161-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-163-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-165-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-164-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-166-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-168-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-169-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-170-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-171-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-172-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-173-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-174-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-175-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-177-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-176-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-178-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-179-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-180-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-181-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-182-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-183-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-184-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/36716-191-0x0000000006460000-0x0000000006472000-memory.dmpFilesize
72KB
-
memory/36716-190-0x0000000008F40000-0x0000000009546000-memory.dmpFilesize
6.0MB
-
memory/36716-192-0x0000000008A40000-0x0000000008B4A000-memory.dmpFilesize
1.0MB
-
memory/36716-195-0x0000000008930000-0x000000000896E000-memory.dmpFilesize
248KB
-
memory/36716-197-0x00000000089A0000-0x00000000089EB000-memory.dmpFilesize
300KB
-
memory/36716-205-0x0000000009A50000-0x0000000009F4E000-memory.dmpFilesize
5.0MB
-
memory/36716-209-0x0000000008C60000-0x0000000008CC6000-memory.dmpFilesize
408KB
-
memory/36716-217-0x0000000009830000-0x00000000098A6000-memory.dmpFilesize
472KB
-
memory/36716-218-0x0000000009950000-0x00000000099E2000-memory.dmpFilesize
584KB
-
memory/36716-222-0x0000000009910000-0x000000000992E000-memory.dmpFilesize
120KB
-
memory/36716-232-0x000000000AF40000-0x000000000B102000-memory.dmpFilesize
1.8MB
-
memory/36716-233-0x000000000B640000-0x000000000BB6C000-memory.dmpFilesize
5.2MB
-
memory/36716-329-0x000000000A310000-0x000000000A360000-memory.dmpFilesize
320KB