Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-09-2022 07:30
Static task
static1
Behavioral task
behavioral1
Sample
9547dd1fc88dc8cef6210d82b3ed0ad8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9547dd1fc88dc8cef6210d82b3ed0ad8.exe
Resource
win10v2004-20220901-en
General
-
Target
9547dd1fc88dc8cef6210d82b3ed0ad8.exe
-
Size
145KB
-
MD5
9547dd1fc88dc8cef6210d82b3ed0ad8
-
SHA1
38eedb531c5ecab6fd3d3f585d7760ee4c5b2d81
-
SHA256
d9f03a142d11c22b9a4d6f672d4d2733d01b9ef3a7d4760910f7c1f766daef0e
-
SHA512
23751bad429149f3e0e0507a62ab043a1dd914ad9f5ff630024e452d9538feadbb257121b43fbc7adb7e937262155410028db4895c6ff9a21bafc681ca770ea4
-
SSDEEP
3072:Y7osI+wJBjzFpTfiP16pNydXSy26+dZCSfwXR4lAmwyktPIX:E9aBjzFpT6N6bydO9RUi
Malware Config
Extracted
redline
Lyla3.12.09
185.215.113.216:21921
-
auth_value
893298c4bebea403e4a59dd151c4fcc2
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9547dd1fc88dc8cef6210d82b3ed0ad8.exedescription pid process target process PID 1848 set thread context of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9547dd1fc88dc8cef6210d82b3ed0ad8.exepid process 968 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 968 9547dd1fc88dc8cef6210d82b3ed0ad8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9547dd1fc88dc8cef6210d82b3ed0ad8.exedescription pid process Token: SeDebugPrivilege 968 9547dd1fc88dc8cef6210d82b3ed0ad8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9547dd1fc88dc8cef6210d82b3ed0ad8.exedescription pid process target process PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe PID 1848 wrote to memory of 968 1848 9547dd1fc88dc8cef6210d82b3ed0ad8.exe 9547dd1fc88dc8cef6210d82b3ed0ad8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9547dd1fc88dc8cef6210d82b3ed0ad8.exe"C:\Users\Admin\AppData\Local\Temp\9547dd1fc88dc8cef6210d82b3ed0ad8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\9547dd1fc88dc8cef6210d82b3ed0ad8.exe"C:\Users\Admin\AppData\Local\Temp\9547dd1fc88dc8cef6210d82b3ed0ad8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-55-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-56-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-58-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-59-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-60-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-61-0x0000000000086ABE-mapping.dmp
-
memory/968-63-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-67-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-70-0x0000000000070000-0x000000000008C000-memory.dmpFilesize
112KB
-
memory/968-71-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB
-
memory/1848-54-0x0000000000330000-0x0000000000358000-memory.dmpFilesize
160KB