Analysis
- max time kernel
91s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
03/10/2022, 17:48
General
- Target file.exe
- Size 6.1MB
- Sample221003-wdevtsheb6
- SHA256 30e0876f337878655c16b21dc5fa5dfa5e5df9c539b2fec89a1fa429a8b62ac8
Malware Config
Extracted
-
redline
-
PremiumCloud#41
-
151.80.89.227:45878
-
auth_value
6011f107082889840844bd9a1730558b
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1308-145-0x0000000000400000-0x0000000000EBB000-memory.dmp
memory/1308-132-0x0000000000400000-0x0000000000EBB000-memory.dmp
memory/80148-148-0x0000000004FC0000-0x0000000004FD2000-memory.dmp
memory/80148-140-0x0000000000400000-0x0000000000428000-memory.dmp
memory/80148-146-0x0000000005510000-0x0000000005B28000-memory.dmp
memory/80148-147-0x0000000005090000-0x000000000519A000-memory.dmp
memory/80148-149-0x0000000005020000-0x000000000505C000-memory.dmp
memory/80148-150-0x00000000053B0000-0x0000000005442000-memory.dmp
memory/80148-151-0x00000000060E0000-0x0000000006684000-memory.dmp
memory/80148-152-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/80148-153-0x0000000006690000-0x0000000006706000-memory.dmp
memory/80148-154-0x0000000006710000-0x0000000006760000-memory.dmp
memory/80148-155-0x0000000006930000-0x0000000006AF2000-memory.dmp
memory/80148-156-0x0000000007030000-0x000000000755C000-memory.dmp