Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2022 16:21
Static task
static1
Behavioral task
behavioral1
Sample
2eef072591fa615c5a3e8762076210d2.exe
Resource
win7-20220715-en
General
-
Target
2eef072591fa615c5a3e8762076210d2.exe
-
Size
2.0MB
-
MD5
2eef072591fa615c5a3e8762076210d2
-
SHA1
9d1346230f5d49439bfa5556f9cd35fc2466217b
-
SHA256
4cc07d33c48084395ed0c7ffcaf9549d9cbe961b7e9c33ef546826cbe3b94817
-
SHA512
325f695ebef428c80371c1d1ddf7bbbab71df12c3a695972c38efdb687d1b9f358736832055337fc834a703b5479faba408f5e57d18d8aba5725ac89513118a6
Malware Config
Extracted
redline
Lyla29.07
185.215.113.216:21921
-
auth_value
ce5605b2c036c2c3b7bdfb23dcf5f5a2
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2eef072591fa615c5a3e8762076210d2.exedescription pid process target process PID 1840 set thread context of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2eef072591fa615c5a3e8762076210d2.exepid process 2856 2eef072591fa615c5a3e8762076210d2.exe 2856 2eef072591fa615c5a3e8762076210d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2eef072591fa615c5a3e8762076210d2.exedescription pid process Token: SeDebugPrivilege 2856 2eef072591fa615c5a3e8762076210d2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2eef072591fa615c5a3e8762076210d2.exedescription pid process target process PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe PID 1840 wrote to memory of 2856 1840 2eef072591fa615c5a3e8762076210d2.exe 2eef072591fa615c5a3e8762076210d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eef072591fa615c5a3e8762076210d2.exe"C:\Users\Admin\AppData\Local\Temp\2eef072591fa615c5a3e8762076210d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2eef072591fa615c5a3e8762076210d2.exe"C:\Users\Admin\AppData\Local\Temp\2eef072591fa615c5a3e8762076210d2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2eef072591fa615c5a3e8762076210d2.exe.logFilesize
42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
memory/1840-130-0x0000000000210000-0x000000000042B000-memory.dmpFilesize
2.1MB
-
memory/2856-138-0x0000000005150000-0x00000000051B6000-memory.dmpFilesize
408KB
-
memory/2856-139-0x0000000005CC0000-0x0000000005D36000-memory.dmpFilesize
472KB
-
memory/2856-134-0x00000000053A0000-0x00000000059B8000-memory.dmpFilesize
6.1MB
-
memory/2856-135-0x0000000004DB0000-0x0000000004DC2000-memory.dmpFilesize
72KB
-
memory/2856-136-0x0000000004EE0000-0x0000000004FEA000-memory.dmpFilesize
1.0MB
-
memory/2856-137-0x0000000004E10000-0x0000000004E4C000-memory.dmpFilesize
240KB
-
memory/2856-131-0x0000000000000000-mapping.dmp
-
memory/2856-132-0x0000000000800000-0x000000000081E000-memory.dmpFilesize
120KB
-
memory/2856-140-0x0000000005E00000-0x0000000005E92000-memory.dmpFilesize
584KB
-
memory/2856-141-0x0000000006450000-0x00000000069F4000-memory.dmpFilesize
5.6MB
-
memory/2856-142-0x0000000005DA0000-0x0000000005DBE000-memory.dmpFilesize
120KB
-
memory/2856-143-0x00000000062F0000-0x0000000006340000-memory.dmpFilesize
320KB
-
memory/2856-144-0x00000000072F0000-0x00000000074B2000-memory.dmpFilesize
1.8MB
-
memory/2856-145-0x00000000079F0000-0x0000000007F1C000-memory.dmpFilesize
5.2MB