Analysis
-
max time kernel
54s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
13-09-2022 22:36
Static task
static1
Behavioral task
behavioral1
Sample
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe
Resource
win10-20220812-en
General
-
Target
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe
-
Size
3.8MB
-
MD5
cd6124575280dd513412db5bd233d32a
-
SHA1
a99cd43c0cf24a8379f74d32ca81067d502b0914
-
SHA256
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf
-
SHA512
e5a1f17913ceecc6a58f6b41b606718594bcaff033e717102f1698992dffb988b82daa2e70b8a1ac335d11b7fcdd85d163f7180a8f614b38b8741a936ee46717
-
SSDEEP
49152:Te9ulU3veN/261EB0mDZ9DU/Q4redt/6b:XlU3veN/hu/6b
Malware Config
Extracted
redline
3108_RUZKI
213.219.247.199:9452
-
auth_value
f71fed1cd094e4e1eb7ad1c53e542bca
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4812-170-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/4812-171-0x000000000041ADD2-mapping.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exedescription pid process target process PID 2832 set thread context of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 4812 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe Token: SeDebugPrivilege 4812 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exedescription pid process target process PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe PID 2832 wrote to memory of 4812 2832 dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe"C:\Users\Admin\AppData\Local\Temp\dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2832-115-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-116-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-117-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-118-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-119-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-120-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-122-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-121-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-124-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-123-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-125-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-126-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-127-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-128-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-129-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-130-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-131-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-132-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-133-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-134-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-135-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-136-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-137-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-138-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-139-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-140-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-141-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-142-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-143-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-144-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-145-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-146-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-147-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-148-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-149-0x0000000000FB0000-0x0000000001378000-memory.dmpFilesize
3.8MB
-
memory/2832-150-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-151-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-152-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-153-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-154-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-155-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-156-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-157-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-158-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-159-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-160-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-161-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-162-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-163-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-164-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-165-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-166-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-167-0x0000000005D90000-0x0000000005DBC000-memory.dmpFilesize
176KB
-
memory/2832-168-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/2832-169-0x0000000005EC0000-0x0000000005F5C000-memory.dmpFilesize
624KB
-
memory/2832-173-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-170-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4812-171-0x000000000041ADD2-mapping.dmp
-
memory/4812-172-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-174-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-175-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-176-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-177-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-178-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-179-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-180-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-181-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-182-0x00000000771B0000-0x000000007733E000-memory.dmpFilesize
1.6MB
-
memory/4812-232-0x0000000005C10000-0x0000000006216000-memory.dmpFilesize
6.0MB
-
memory/4812-233-0x00000000056A0000-0x00000000056B2000-memory.dmpFilesize
72KB
-
memory/4812-234-0x00000000057D0000-0x00000000058DA000-memory.dmpFilesize
1.0MB
-
memory/4812-237-0x0000000005700000-0x000000000573E000-memory.dmpFilesize
248KB
-
memory/4812-239-0x0000000005740000-0x000000000578B000-memory.dmpFilesize
300KB
-
memory/4812-243-0x0000000006720000-0x0000000006C1E000-memory.dmpFilesize
5.0MB
-
memory/4812-245-0x0000000005A50000-0x0000000005AB6000-memory.dmpFilesize
408KB
-
memory/4812-253-0x0000000006620000-0x0000000006696000-memory.dmpFilesize
472KB
-
memory/4812-254-0x0000000006CC0000-0x0000000006D52000-memory.dmpFilesize
584KB
-
memory/4812-258-0x0000000006700000-0x000000000671E000-memory.dmpFilesize
120KB
-
memory/4812-260-0x0000000007DA0000-0x0000000007F62000-memory.dmpFilesize
1.8MB
-
memory/4812-261-0x00000000084A0000-0x00000000089CC000-memory.dmpFilesize
5.2MB