Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15-09-2022 05:55
Static task
static1
Behavioral task
behavioral1
Sample
4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe
Resource
win10-20220812-en
General
-
Target
4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe
-
Size
1.1MB
-
MD5
bfde857f58b339dc052d20942cfec82d
-
SHA1
dcced573fc78f4bdcfe7cc6d4d4a462e2781d114
-
SHA256
4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6
-
SHA512
72a98d0861433cad7eefd2ac0d643488528c6366f49e0a31573a95db0e87ac66756ca62432df52ce99bda84f63484d503b48d9d54602a7c5f40a1241b32f4960
-
SSDEEP
24576:LIfdfYfYKKx7eoBlMvgRYn0UvlrbthqgOVKvA:LIR2RbCAvA
Malware Config
Extracted
redline
5201435440
79.137.192.6:8362
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/154380-127-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/154380-132-0x000000000041972E-mapping.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exedescription pid process target process PID 2684 set thread context of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 154380 AppLaunch.exe 154380 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 154380 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exedescription pid process target process PID 2684 wrote to memory of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe PID 2684 wrote to memory of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe PID 2684 wrote to memory of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe PID 2684 wrote to memory of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe PID 2684 wrote to memory of 154380 2684 4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe"C:\Users\Admin\AppData\Local\Temp\4c207bce926efb535bb745c93bef1d74adfea7d0451f81fb48c678b1178d71c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-121-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-122-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-123-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-124-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-125-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-126-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-127-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/154380-132-0x000000000041972E-mapping.dmp
-
memory/154380-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-135-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-143-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-144-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-156-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-159-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-162-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-163-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-164-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-167-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-168-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-169-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-172-0x0000000009490000-0x0000000009A96000-memory.dmpFilesize
6.0MB
-
memory/154380-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-174-0x0000000008DE0000-0x0000000008DF2000-memory.dmpFilesize
72KB
-
memory/154380-175-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-176-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-179-0x0000000008E80000-0x0000000008EBE000-memory.dmpFilesize
248KB
-
memory/154380-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-182-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-183-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-184-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-185-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-186-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-187-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-188-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-189-0x0000000008E00000-0x0000000008E4B000-memory.dmpFilesize
300KB
-
memory/154380-190-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-191-0x00000000090E0000-0x00000000091EA000-memory.dmpFilesize
1.0MB
-
memory/154380-196-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-197-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/154380-226-0x000000000A010000-0x000000000A1D2000-memory.dmpFilesize
1.8MB
-
memory/154380-227-0x000000000A710000-0x000000000AC3C000-memory.dmpFilesize
5.2MB
-
memory/154380-230-0x0000000009F70000-0x0000000009FD6000-memory.dmpFilesize
408KB
-
memory/154380-331-0x000000000B140000-0x000000000B63E000-memory.dmpFilesize
5.0MB
-
memory/154380-342-0x000000000A5E0000-0x000000000A656000-memory.dmpFilesize
472KB
-
memory/154380-343-0x000000000AC40000-0x000000000ACD2000-memory.dmpFilesize
584KB
-
memory/154380-347-0x000000000ADE0000-0x000000000ADFE000-memory.dmpFilesize
120KB