Analysis
-
max time kernel
26s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-09-2022 04:11
Static task
static1
Behavioral task
behavioral1
Sample
Valorant Skin Changer.exe
Resource
win7-20220812-en
General
-
Target
Valorant Skin Changer.exe
-
Size
463KB
-
MD5
614fdab08259badfde733dcb31f7136b
-
SHA1
f8a4f0bbba13c8590a69b7d3afdb757d8a3349e6
-
SHA256
020b635a94c45367c89ec249a40ca829163c988c02ba308d111041245da801cb
-
SHA512
2ffd92175f43a63f7e13e22b08cc6ac4fb509667ad9c92c61f531faee4d4428ad7d461fb2071f81bfa1a197ba2ee0bf970eb9cb51cf2cb96c35e9f93620202d4
-
SSDEEP
6144:pzCQyNPBUwSu4Tuk7S67FBwmatf37y43VELKSv3s6WWXVibtLmlxXFAOMMsESjL+:wU9uAz3wmatfKXvnWWXctmXFJ0Xj0b
Malware Config
Extracted
redline
62.204.41.141:24758
-
auth_value
b34b8a919a71ed4027bc3f495b7f799e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/150848-56-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/150848-61-0x000000000041B53E-mapping.dmp family_redline behavioral1/memory/150848-62-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/150848-63-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Valorant Skin Changer.exedescription pid process target process PID 1132 set thread context of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 150896 1132 WerFault.exe Valorant Skin Changer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 150848 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 150848 AppLaunch.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Valorant Skin Changer.exedescription pid process target process PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150848 1132 Valorant Skin Changer.exe AppLaunch.exe PID 1132 wrote to memory of 150896 1132 Valorant Skin Changer.exe WerFault.exe PID 1132 wrote to memory of 150896 1132 Valorant Skin Changer.exe WerFault.exe PID 1132 wrote to memory of 150896 1132 Valorant Skin Changer.exe WerFault.exe PID 1132 wrote to memory of 150896 1132 Valorant Skin Changer.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Valorant Skin Changer.exe"C:\Users\Admin\AppData\Local\Temp\Valorant Skin Changer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 1495082⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/150848-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/150848-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/150848-61-0x000000000041B53E-mapping.dmp
-
memory/150848-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/150848-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/150848-64-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB
-
memory/150896-65-0x0000000000000000-mapping.dmp