Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 02:34
Static task
static1
Behavioral task
behavioral1
Sample
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
Resource
win10v2004-20220812-en
General
-
Target
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe
-
Size
2.8MB
-
MD5
bc0f88560edfbd4782b5731f3ee7cb08
-
SHA1
f5e9bd90666f80ff36dcc68b501e35cad94751df
-
SHA256
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0
-
SHA512
d78dde3abc068e3f43e8784c7c62cf0b46c0e86c7ee2be7613a30fc4aba7c152a72ea73cd9b6990e892199df2b91121ab2daa0457b4722f0557a53fb91ad82e6
-
SSDEEP
49152:3XQXV7UeuVlzqiNV5qlWc0i0yf5Nh6lKa35l3l:3XQXV7Ueolz9fmvf5Nh6lB9
Malware Config
Extracted
redline
Install
69.176.94.78:32244
-
auth_value
262df95952285ebeabc4c91774e37776
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/100256-133-0x0000000000400000-0x0000000000460000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exedescription pid process target process PID 4656 set thread context of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 100256 AppLaunch.exe 100256 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 100256 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exedescription pid process target process PID 4656 wrote to memory of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 4656 wrote to memory of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 4656 wrote to memory of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 4656 wrote to memory of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe PID 4656 wrote to memory of 100256 4656 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe"C:\Users\Admin\AppData\Local\Temp\7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/100256-132-0x0000000000000000-mapping.dmp
-
memory/100256-133-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/100256-138-0x000000000B800000-0x000000000BE18000-memory.dmpFilesize
6.1MB
-
memory/100256-139-0x000000000B3E0000-0x000000000B4EA000-memory.dmpFilesize
1.0MB
-
memory/100256-140-0x000000000B310000-0x000000000B322000-memory.dmpFilesize
72KB
-
memory/100256-141-0x000000000B370000-0x000000000B3AC000-memory.dmpFilesize
240KB
-
memory/100256-142-0x000000000DF30000-0x000000000E4D4000-memory.dmpFilesize
5.6MB
-
memory/100256-143-0x000000000D980000-0x000000000DA12000-memory.dmpFilesize
584KB
-
memory/100256-144-0x000000000DA20000-0x000000000DA86000-memory.dmpFilesize
408KB
-
memory/100256-145-0x000000000DC10000-0x000000000DC86000-memory.dmpFilesize
472KB
-
memory/100256-146-0x000000000DC90000-0x000000000DCE0000-memory.dmpFilesize
320KB
-
memory/100256-147-0x000000000F160000-0x000000000F322000-memory.dmpFilesize
1.8MB
-
memory/100256-148-0x000000000F860000-0x000000000FD8C000-memory.dmpFilesize
5.2MB