Analysis
-
max time kernel
115s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
31-07-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe
Resource
win10-20220718-en
General
-
Target
2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe
-
Size
2.5MB
-
MD5
a96950e973081e1145547d3c5bcac94f
-
SHA1
3d72c767397db4498a4ab7cda505f8a1fcc7ba4b
-
SHA256
2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912
-
SHA512
c824a162d019b0c272c14b3bfa5cc75d8ca8662025c36358194f84163b95f95b5263b64da5c7e1e942d395a438f3d1d8843319f479d9f7a99cf190d7114ee03a
Malware Config
Extracted
redline
top1
pemararslava.xyz:80
-
auth_value
e3ff30d1ffe0ffdb11211b351a0179a1
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exedescription pid process target process PID 3292 set thread context of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 197004 AppLaunch.exe 197004 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 197004 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exedescription pid process target process PID 3292 wrote to memory of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe PID 3292 wrote to memory of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe PID 3292 wrote to memory of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe PID 3292 wrote to memory of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe PID 3292 wrote to memory of 197004 3292 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe"C:\Users\Admin\AppData\Local\Temp\2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3292-114-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-115-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-116-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-117-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-118-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-119-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-120-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/3292-121-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-122-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/197004-127-0x000000000041817E-mapping.dmp
-
memory/197004-128-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-129-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-130-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-131-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-132-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-134-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-135-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-138-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-137-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-139-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-140-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-141-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-142-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-143-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-144-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-145-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-146-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-147-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-148-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-149-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-150-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-151-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-152-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-153-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-154-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-155-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-156-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-157-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-158-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-159-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-161-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-162-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-163-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-164-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-165-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-166-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-167-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-168-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-169-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-170-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-171-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-172-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-173-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-174-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-175-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-176-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-177-0x0000000009B10000-0x000000000A116000-memory.dmpFilesize
6.0MB
-
memory/197004-178-0x0000000009500000-0x0000000009512000-memory.dmpFilesize
72KB
-
memory/197004-179-0x0000000009630000-0x000000000973A000-memory.dmpFilesize
1.0MB
-
memory/197004-180-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-181-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-182-0x0000000009560000-0x000000000959E000-memory.dmpFilesize
248KB
-
memory/197004-183-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-184-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-185-0x0000000077270000-0x00000000773FE000-memory.dmpFilesize
1.6MB
-
memory/197004-190-0x00000000095A0000-0x00000000095EB000-memory.dmpFilesize
300KB
-
memory/197004-234-0x000000000AE90000-0x000000000B38E000-memory.dmpFilesize
5.0MB
-
memory/197004-237-0x000000000AA50000-0x000000000AAC6000-memory.dmpFilesize
472KB
-
memory/197004-238-0x000000000AB70000-0x000000000AC02000-memory.dmpFilesize
584KB
-
memory/197004-242-0x000000000AB30000-0x000000000AB4E000-memory.dmpFilesize
120KB
-
memory/197004-244-0x000000000B400000-0x000000000B466000-memory.dmpFilesize
408KB
-
memory/197004-256-0x000000000B800000-0x000000000B9C2000-memory.dmpFilesize
1.8MB
-
memory/197004-257-0x000000000BF00000-0x000000000C42C000-memory.dmpFilesize
5.2MB