Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2022 11:56
Static task
static1
Behavioral task
behavioral1
Sample
60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe
Resource
win10v2004-20220812-en
General
-
Target
60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe
-
Size
1.4MB
-
MD5
e9a4f34e8ae18813cd5391c264a66e45
-
SHA1
abc1fd2eda12ea13dce39eeb7b695e70b4cac145
-
SHA256
60974f5d63c5b3f74654b4703bf1a7b56662e016ff184f675da1a78ac96c7b16
-
SHA512
5092cc311b2d0ff983bfb66cc50a62d3541fae4f5d7ef489ebd177c92dd3f2a6cb3615f4e82ff99c84f62ffedec117dbad3abf6e347da27c078c815c441e51e8
-
SSDEEP
24576:Q1GEXEZXOYPYCfy0GmoMkXdLeF2bVRbRfIR5tegepbjLh3RLu:Q1ZEZ2gu2R+bjLh3RC
Malware Config
Extracted
redline
h
95.217.55.221:25921
-
auth_value
4ff47750f2415702232d09cbc50b7130
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exedescription pid process target process PID 3776 set thread context of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 197072 AppLaunch.exe 197072 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 197072 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exedescription pid process target process PID 3776 wrote to memory of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe PID 3776 wrote to memory of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe PID 3776 wrote to memory of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe PID 3776 wrote to memory of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe PID 3776 wrote to memory of 197072 3776 60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe"C:\Users\Admin\AppData\Local\Temp\60974F5D63C5B3F74654B4703BF1A7B56662E016FF184.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/197072-132-0x0000000000000000-mapping.dmp
-
memory/197072-133-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/197072-138-0x0000000005500000-0x0000000005B18000-memory.dmpFilesize
6.1MB
-
memory/197072-139-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/197072-140-0x0000000005010000-0x000000000511A000-memory.dmpFilesize
1.0MB
-
memory/197072-141-0x0000000004F40000-0x0000000004F7C000-memory.dmpFilesize
240KB
-
memory/197072-142-0x00000000060D0000-0x0000000006674000-memory.dmpFilesize
5.6MB
-
memory/197072-143-0x00000000053E0000-0x0000000005472000-memory.dmpFilesize
584KB
-
memory/197072-144-0x0000000005480000-0x00000000054F6000-memory.dmpFilesize
472KB
-
memory/197072-145-0x0000000005B80000-0x0000000005B9E000-memory.dmpFilesize
120KB
-
memory/197072-146-0x0000000005E60000-0x0000000005EC6000-memory.dmpFilesize
408KB
-
memory/197072-147-0x0000000006B50000-0x0000000006D12000-memory.dmpFilesize
1.8MB
-
memory/197072-148-0x0000000007250000-0x000000000777C000-memory.dmpFilesize
5.2MB
-
memory/197072-149-0x0000000006AF0000-0x0000000006B40000-memory.dmpFilesize
320KB