Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 02:34
Static task
static1
Behavioral task
behavioral1
Sample
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
Resource
win10v2004-20220812-en
General
-
Target
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
-
Size
2.8MB
-
MD5
bc0f88560edfbd4782b5731f3ee7cb08
-
SHA1
f5e9bd90666f80ff36dcc68b501e35cad94751df
-
SHA256
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0
-
SHA512
d78dde3abc068e3f43e8784c7c62cf0b46c0e86c7ee2be7613a30fc4aba7c152a72ea73cd9b6990e892199df2b91121ab2daa0457b4722f0557a53fb91ad82e6
-
SSDEEP
49152:3XQXV7UeuVlzqiNV5qlWc0i0yf5Nh6lKa35l3l:3XQXV7Ueolz9fmvf5Nh6lB9
Malware Config
Extracted
redline
Install
69.176.94.78:32244
-
auth_value
262df95952285ebeabc4c91774e37776
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/98312-56-0x0000000000400000-0x0000000000460000-memory.dmp family_redline behavioral1/memory/98312-61-0x000000000045AD4E-mapping.dmp family_redline behavioral1/memory/98312-62-0x0000000000400000-0x0000000000460000-memory.dmp family_redline behavioral1/memory/98312-63-0x0000000000400000-0x0000000000460000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exedescription pid process target process PID 1660 set thread context of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 98312 AppLaunch.exe 98312 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 98312 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exedescription pid process target process PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 1660 wrote to memory of 98312 1660 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe"C:\Users\Admin\AppData\Local\Temp\7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/98312-54-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/98312-56-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/98312-61-0x000000000045AD4E-mapping.dmp
-
memory/98312-62-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/98312-63-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/98312-64-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/98312-65-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB