Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
13-09-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
02f39120cf2af18509b2c0fff30720f6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
02f39120cf2af18509b2c0fff30720f6.exe
Resource
win10v2004-20220812-en
General
-
Target
02f39120cf2af18509b2c0fff30720f6.exe
-
Size
164KB
-
MD5
02f39120cf2af18509b2c0fff30720f6
-
SHA1
8691a14f1446f9ae054ab8963f3261a614e67813
-
SHA256
8779883519f92381535a03225ef0973412fdaa42d8a6becf179c7f69b8f91e23
-
SHA512
9e6309ab852e9a4d9db39037ea1826998c69d8c842cc376329c2b967691b2701ce7b7b77813bf4fa96f37d2ba5cf6d17522def8dc914ca78381a8a608ce1e378
-
SSDEEP
1536:Zt51pJxJn/PS1tblbr50vEwBjzktL/8Jt8MC5wwEn78rtajTm4H//gkp/zgLOCWo:Zt51pJxNShxRwBjziULwHR4TzXVpqIc
Malware Config
Extracted
redline
Lyla.11.09
185.215.113.216:21921
-
auth_value
a1e5192e588aa983d678ceb4d6e0d8b5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
02f39120cf2af18509b2c0fff30720f6.exedescription pid process target process PID 1752 set thread context of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
02f39120cf2af18509b2c0fff30720f6.exepid process 1584 02f39120cf2af18509b2c0fff30720f6.exe 1584 02f39120cf2af18509b2c0fff30720f6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
02f39120cf2af18509b2c0fff30720f6.exedescription pid process Token: SeDebugPrivilege 1584 02f39120cf2af18509b2c0fff30720f6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
02f39120cf2af18509b2c0fff30720f6.exedescription pid process target process PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe PID 1752 wrote to memory of 1584 1752 02f39120cf2af18509b2c0fff30720f6.exe 02f39120cf2af18509b2c0fff30720f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f39120cf2af18509b2c0fff30720f6.exe"C:\Users\Admin\AppData\Local\Temp\02f39120cf2af18509b2c0fff30720f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\02f39120cf2af18509b2c0fff30720f6.exe"C:\Users\Admin\AppData\Local\Temp\02f39120cf2af18509b2c0fff30720f6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-55-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-56-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-58-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-59-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-60-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-61-0x0000000000086ABA-mapping.dmp
-
memory/1584-63-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-67-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-70-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/1584-71-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1752-54-0x0000000000390000-0x00000000003BD000-memory.dmpFilesize
180KB