Analysis
-
max time kernel
165s -
max time network
182s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
06-07-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe
Resource
win10-20220414-en
General
-
Target
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe
-
Size
1.6MB
-
MD5
08368d481bb00407dd744349ce9653a7
-
SHA1
cf1210eca1029d0eb9f9fb792619ad57bbdb0180
-
SHA256
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944
-
SHA512
51971b4d8887a0391f6256c85051665a3ae7dd944c7bc4485959b36498f8e3f2ac401eccd2954f6a20b3ffb827406d554499b28a64f525fa7324dd65f9dd5e77
Malware Config
Extracted
redline
SUBZERO
185.215.113.217:19618
-
auth_value
019ff2a82025cde517e4466362191205
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4736-174-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exedescription pid process target process PID 2344 set thread context of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exepid process 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
InstallUtil.exedescription pid process Token: SeDebugPrivilege 4736 InstallUtil.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exedescription pid process target process PID 2344 wrote to memory of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe PID 2344 wrote to memory of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe PID 2344 wrote to memory of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe PID 2344 wrote to memory of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe PID 2344 wrote to memory of 4736 2344 6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe"C:\Users\Admin\AppData\Local\Temp\6f47a63c27a7b43f0e02519f48775a6c4ea7ecaa3100a9aced76818886551944.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2344-118-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-119-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-120-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-121-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-122-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-123-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-124-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-125-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-126-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-127-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-128-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-129-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-130-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-131-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-132-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-133-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-135-0x0000000002810000-0x0000000002D34000-memory.dmpFilesize
5.1MB
-
memory/2344-136-0x0000000002810000-0x0000000002D34000-memory.dmpFilesize
5.1MB
-
memory/2344-138-0x0000000000D80000-0x0000000000EC8000-memory.dmpFilesize
1.3MB
-
memory/2344-139-0x0000000000D80000-0x0000000000EC8000-memory.dmpFilesize
1.3MB
-
memory/2344-140-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-141-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-142-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-143-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-144-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-145-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-146-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-147-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-148-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-149-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-150-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-151-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-152-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-153-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-154-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-155-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-156-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-157-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-158-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-159-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-160-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-161-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-162-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-163-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-164-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-165-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-167-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-166-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-168-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-170-0x000000000C420000-0x000000000C556000-memory.dmpFilesize
1.2MB
-
memory/2344-169-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2344-171-0x000000000C420000-0x000000000C556000-memory.dmpFilesize
1.2MB
-
memory/4736-172-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4736-174-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4736-175-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-176-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-177-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-178-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-179-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-180-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-181-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-182-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-183-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-184-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-185-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-186-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-187-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-188-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-189-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4736-226-0x00000000052C0000-0x00000000058C6000-memory.dmpFilesize
6.0MB
-
memory/4736-227-0x0000000004CD0000-0x0000000004CE2000-memory.dmpFilesize
72KB
-
memory/4736-228-0x0000000004E00000-0x0000000004F0A000-memory.dmpFilesize
1.0MB
-
memory/4736-231-0x0000000004D30000-0x0000000004D6E000-memory.dmpFilesize
248KB
-
memory/4736-233-0x0000000004DB0000-0x0000000004DFB000-memory.dmpFilesize
300KB
-
memory/4736-238-0x0000000005070000-0x00000000050D6000-memory.dmpFilesize
408KB
-
memory/4736-246-0x0000000005BD0000-0x0000000005C46000-memory.dmpFilesize
472KB
-
memory/4736-247-0x0000000005D20000-0x0000000005DB2000-memory.dmpFilesize
584KB
-
memory/4736-248-0x00000000062C0000-0x00000000067BE000-memory.dmpFilesize
5.0MB
-
memory/4736-252-0x0000000005C80000-0x0000000005C9E000-memory.dmpFilesize
120KB
-
memory/4736-253-0x00000000067C0000-0x0000000006982000-memory.dmpFilesize
1.8MB
-
memory/4736-254-0x0000000006EC0000-0x00000000073EC000-memory.dmpFilesize
5.2MB