Analysis
- max time kernel
91s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
07/10/2022, 10:26
General
- Target a23edc8ced38a13512f37240c8dee007c7961aec410f0.exe
- Size 2.6MB
- Sample221007-mgjhracbf3
- SHA256 a23edc8ced38a13512f37240c8dee007c7961aec410f0aaeb9f3f966a837eab8
Malware Config
Extracted
-
redline
-
1609
-
b47n300.info:81
-
auth_value
be2b8c78370c8ccdb9160713c866e49b
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a23edc8ced38a13512f37240c8dee007c7961aec410f0.exe"C:\Users\Admin\AppData\Local\Temp\a23edc8ced38a13512f37240c8dee007c7961aec410f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/100580-133-0x0000000000400000-0x0000000000426000-memory.dmp
memory/100580-137-0x00000000059A0000-0x0000000005FB8000-memory.dmp
memory/100580-138-0x0000000005440000-0x0000000005452000-memory.dmp
memory/100580-139-0x0000000005570000-0x000000000567A000-memory.dmp
memory/100580-140-0x00000000054A0000-0x00000000054DC000-memory.dmp
memory/100580-141-0x0000000006670000-0x00000000066D6000-memory.dmp
memory/100580-142-0x0000000006890000-0x0000000006922000-memory.dmp
memory/100580-143-0x0000000006EE0000-0x0000000007484000-memory.dmp
memory/100580-144-0x0000000008110000-0x00000000082D2000-memory.dmp
memory/100580-145-0x0000000008810000-0x0000000008D3C000-memory.dmp