Analysis
-
max time kernel
54s -
max time network
183s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
02-10-2022 22:20
Static task
static1
Behavioral task
behavioral1
Sample
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe
Resource
win10-20220812-en
General
-
Target
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe
-
Size
1.4MB
-
MD5
e32cf33433b5635501885a6bf12ff2a9
-
SHA1
4a9a7d6c7bf8cb9e64c9bddfe60031e06804a58d
-
SHA256
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6
-
SHA512
868aefac1226b5a6f2c7cf2e7588a457dc871659867863631ab938631bd90f6d67573dc1a39ad9199063e19b9b0ecce3506e762ab3a0d7287e30d7736cd86754
-
SSDEEP
24576:G9KJu8M5sw86BP6SBD8iHVJP19u/OpCmA0oPRw9gvJmWTDDq9xa/9F:G9d8yF8QP6a8At9ucxca+vJn3oa/
Malware Config
Extracted
redline
IMHOTEP
185.215.113.217:19618
-
auth_value
6ab091fd3a77232d89f167fd3318223a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4728-175-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exedescription pid process target process PID 2668 set thread context of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exeInstallUtil.exepid process 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe 4728 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
InstallUtil.exedescription pid process Token: SeDebugPrivilege 4728 InstallUtil.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exedescription pid process target process PID 2668 wrote to memory of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe PID 2668 wrote to memory of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe PID 2668 wrote to memory of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe PID 2668 wrote to memory of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe PID 2668 wrote to memory of 4728 2668 e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe"C:\Users\Admin\AppData\Local\Temp\e822f7561f691758e216de6b04c0d6a1c4604766fa5de24b548f2d48fe211ee6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-119-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-118-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-120-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-121-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-122-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-123-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-124-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-125-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-126-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-127-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-128-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-129-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-130-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-131-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-132-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-134-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-135-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-133-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-136-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-137-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-139-0x00000000023E0000-0x0000000002A83000-memory.dmpFilesize
6.6MB
-
memory/2668-141-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-142-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-143-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-144-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-145-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-146-0x0000000002A90000-0x0000000002BE7000-memory.dmpFilesize
1.3MB
-
memory/2668-147-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-148-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-149-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-151-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-150-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-152-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-153-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-154-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-155-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-156-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-157-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-158-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-159-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-160-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-161-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-162-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-163-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-164-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-165-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-166-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-167-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-168-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-169-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-170-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-171-0x000000000E680000-0x000000000E7DD000-memory.dmpFilesize
1.4MB
-
memory/2668-172-0x000000000E680000-0x000000000E7DD000-memory.dmpFilesize
1.4MB
-
memory/4728-173-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4728-175-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4728-176-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-177-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-180-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-179-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-178-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-181-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-182-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-183-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-184-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-185-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-186-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4728-227-0x0000000005940000-0x0000000005F46000-memory.dmpFilesize
6.0MB
-
memory/4728-228-0x0000000005440000-0x000000000554A000-memory.dmpFilesize
1.0MB
-
memory/4728-230-0x0000000005350000-0x0000000005362000-memory.dmpFilesize
72KB
-
memory/4728-232-0x00000000053B0000-0x00000000053EE000-memory.dmpFilesize
248KB
-
memory/4728-234-0x00000000053F0000-0x000000000543B000-memory.dmpFilesize
300KB
-
memory/4728-238-0x0000000006450000-0x000000000694E000-memory.dmpFilesize
5.0MB
-
memory/4728-240-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/4728-248-0x00000000062F0000-0x0000000006382000-memory.dmpFilesize
584KB
-
memory/4728-253-0x0000000007960000-0x0000000007B22000-memory.dmpFilesize
1.8MB
-
memory/4728-254-0x0000000008060000-0x000000000858C000-memory.dmpFilesize
5.2MB