Analysis
-
max time kernel
57s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 20:01
Static task
static1
Behavioral task
behavioral1
Sample
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe
Resource
win10-20220718-en
General
-
Target
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe
-
Size
783KB
-
MD5
f84905c8ef2f1a66d371f78f5eef018c
-
SHA1
db9b70232eec3d62d2c7bb6a2ae2bdb637286760
-
SHA256
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7
-
SHA512
ffe297457c73e1497a7dea57ede5ad4b2c694c6b785d7981454b860aae72a176f656ab6903d931a76fabe26f7ae12c6eb547b179402a1cb9d934701fe214140f
Malware Config
Extracted
redline
TPB-ACTIVATOR
amrican-sport-live-stream.cc:4581
-
auth_value
df7c91432437b11d8f25d54ba7832b8d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4636-182-0x0000000000400000-0x0000000000444000-memory.dmp family_redline behavioral1/memory/4636-183-0x000000000043E6BE-mapping.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exedescription pid process target process PID 2228 set thread context of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exeRegAsm.exepid process 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe 4636 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe Token: SeDebugPrivilege 4636 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exedescription pid process target process PID 2228 wrote to memory of 4672 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4672 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4672 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe PID 2228 wrote to memory of 4636 2228 dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe"C:\Users\Admin\AppData\Local\Temp\dcf6833e580432fec0174bdb64dced1e9e9abf086a77a5799138d807499a22f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2228-117-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-118-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-119-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-120-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-121-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-122-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-123-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-124-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-125-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-126-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-127-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-128-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-129-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-130-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-131-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-132-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-133-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-134-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-135-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-136-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-137-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-138-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-139-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-140-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-141-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-142-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-143-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-144-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-145-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-146-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-147-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-148-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-149-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-150-0x0000000000CA0000-0x0000000000D6A000-memory.dmpFilesize
808KB
-
memory/2228-151-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-152-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-153-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-154-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-155-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-156-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-157-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-158-0x0000000005570000-0x00000000055E0000-memory.dmpFilesize
448KB
-
memory/2228-159-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/2228-160-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-161-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-162-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-163-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-164-0x0000000005530000-0x0000000005552000-memory.dmpFilesize
136KB
-
memory/2228-165-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-166-0x00000000057E0000-0x0000000005B30000-memory.dmpFilesize
3.3MB
-
memory/2228-167-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-168-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-169-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-170-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-171-0x000000002B270000-0x000000002B2D6000-memory.dmpFilesize
408KB
-
memory/2228-172-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-173-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-174-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-175-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-176-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-177-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-178-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-179-0x000000002B720000-0x000000002B7B2000-memory.dmpFilesize
584KB
-
memory/2228-180-0x000000002BCC0000-0x000000002C1BE000-memory.dmpFilesize
5.0MB
-
memory/2228-181-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/2228-185-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-182-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4636-183-0x000000000043E6BE-mapping.dmp
-
memory/4636-184-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-186-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-187-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-188-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-189-0x0000000077510000-0x000000007769E000-memory.dmpFilesize
1.6MB
-
memory/4636-237-0x0000000005560000-0x0000000005566000-memory.dmpFilesize
24KB
-
memory/4636-249-0x0000000005BB0000-0x00000000061B6000-memory.dmpFilesize
6.0MB
-
memory/4636-250-0x0000000005620000-0x0000000005632000-memory.dmpFilesize
72KB
-
memory/4636-251-0x0000000005750000-0x000000000585A000-memory.dmpFilesize
1.0MB
-
memory/4636-254-0x0000000005680000-0x00000000056BE000-memory.dmpFilesize
248KB
-
memory/4636-256-0x00000000056F0000-0x000000000573B000-memory.dmpFilesize
300KB
-
memory/4636-265-0x0000000005AD0000-0x0000000005B46000-memory.dmpFilesize
472KB
-
memory/4636-269-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/4636-278-0x00000000072A0000-0x0000000007462000-memory.dmpFilesize
1.8MB
-
memory/4636-279-0x0000000008E50000-0x000000000937C000-memory.dmpFilesize
5.2MB
-
memory/4636-284-0x0000000007470000-0x00000000074C0000-memory.dmpFilesize
320KB