Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
05/08/2022, 09:56
General
- Target 09b68147c9e8e0287b564bbc303cfbf7.exe
- Size 1.2MB
- Sample220805-lycwvsahbr
- SHA256 ce8df7a2a6f03fe45fab255c48401b9712ad1aefdfab26a10f6a34c11ced3138
Malware Config
Extracted
-
redline
-
415968881
-
tomorrowknoks.top:21330
-
auth_value
f28b4cba7cb6f70980f10f30582c3b3b
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b68147c9e8e0287b564bbc303cfbf7.exe"C:\Users\Admin\AppData\Local\Temp\09b68147c9e8e0287b564bbc303cfbf7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/182804-131-0x0000000000400000-0x000000000041E000-memory.dmp
memory/182804-136-0x0000000005C50000-0x0000000006268000-memory.dmp
memory/182804-137-0x00000000056F0000-0x0000000005702000-memory.dmp
memory/182804-138-0x0000000005820000-0x000000000592A000-memory.dmp
memory/182804-139-0x0000000005750000-0x000000000578C000-memory.dmp
memory/182804-140-0x0000000006820000-0x0000000006DC4000-memory.dmp
memory/182804-141-0x0000000006270000-0x0000000006302000-memory.dmp
memory/182804-142-0x0000000006310000-0x0000000006376000-memory.dmp
memory/182804-143-0x0000000006700000-0x0000000006776000-memory.dmp
memory/182804-144-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
memory/182804-145-0x0000000008470000-0x00000000084C0000-memory.dmp
memory/182804-146-0x0000000009240000-0x0000000009402000-memory.dmp
memory/182804-147-0x0000000009940000-0x0000000009E6C000-memory.dmp