Analysis
-
max time kernel
82s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 21:27
Static task
static1
Behavioral task
behavioral1
Sample
2d4c6d3afba4eeee3895c60c42be285e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2d4c6d3afba4eeee3895c60c42be285e.exe
Resource
win10v2004-20220414-en
General
-
Target
2d4c6d3afba4eeee3895c60c42be285e.exe
-
Size
1.3MB
-
MD5
2d4c6d3afba4eeee3895c60c42be285e
-
SHA1
4a9951869b11d9393365507422bbbeee9ed282a8
-
SHA256
9afc87589b3c76f6c50238294539f53eb38a51f61b7d38db4637582f6b168692
-
SHA512
d7347c8ecb2773abd32e9edb1e8606057751ffc82f5659014f830d8287fa1784b398cf84b1974d45077c05997ced9cfe5ca3b6f0e68ee50af376c582db11f37d
Malware Config
Extracted
redline
185.106.92.20:33168
-
auth_value
473a7a67f3a5b581eee05af44809068a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2d4c6d3afba4eeee3895c60c42be285e.exedescription pid process target process PID 5052 set thread context of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 335544 5052 WerFault.exe 2d4c6d3afba4eeee3895c60c42be285e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 335408 AppLaunch.exe 335408 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 335408 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2d4c6d3afba4eeee3895c60c42be285e.exedescription pid process target process PID 5052 wrote to memory of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe PID 5052 wrote to memory of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe PID 5052 wrote to memory of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe PID 5052 wrote to memory of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe PID 5052 wrote to memory of 335408 5052 2d4c6d3afba4eeee3895c60c42be285e.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4c6d3afba4eeee3895c60c42be285e.exe"C:\Users\Admin\AppData\Local\Temp\2d4c6d3afba4eeee3895c60c42be285e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 3323762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 50521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/335408-130-0x0000000000000000-mapping.dmp
-
memory/335408-131-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/335408-136-0x0000000005A10000-0x0000000006028000-memory.dmpFilesize
6.1MB
-
memory/335408-137-0x00000000054A0000-0x00000000054B2000-memory.dmpFilesize
72KB
-
memory/335408-138-0x00000000055D0000-0x00000000056DA000-memory.dmpFilesize
1.0MB
-
memory/335408-139-0x0000000005500000-0x000000000553C000-memory.dmpFilesize
240KB
-
memory/335408-140-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/335408-141-0x00000000063B0000-0x0000000006426000-memory.dmpFilesize
472KB
-
memory/335408-142-0x00000000064F0000-0x0000000006582000-memory.dmpFilesize
584KB
-
memory/335408-143-0x0000000006B40000-0x00000000070E4000-memory.dmpFilesize
5.6MB
-
memory/335408-144-0x00000000066B0000-0x00000000066CE000-memory.dmpFilesize
120KB
-
memory/335408-145-0x00000000068E0000-0x0000000006930000-memory.dmpFilesize
320KB
-
memory/335408-146-0x0000000007D70000-0x0000000007F32000-memory.dmpFilesize
1.8MB
-
memory/335408-147-0x0000000008470000-0x000000000899C000-memory.dmpFilesize
5.2MB