Analysis
- max time kernel
57s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
22/10/2022, 04:21
General
- Target 3165acbd49e8be1e98508602a89a03d2.exe
- Size 2.3MB
- Sample221022-eyn6kaaeg9
- SHA256 bba7be0678f2d6101ee7ad6bfb69f12c32bddebbdeefe27c8a07c7e744b240c8
Malware Config
Extracted
-
redline
-
1340372385_99
-
aliatabako.xyz:28786
-
auth_value
c9aa9e634409f18a2984047a5d362a94
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3165acbd49e8be1e98508602a89a03d2.exe"C:\Users\Admin\AppData\Local\Temp\3165acbd49e8be1e98508602a89a03d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2908-139-0x0000000000400000-0x0000000000547000-memory.dmp
memory/2908-132-0x0000000000400000-0x0000000000547000-memory.dmp
memory/105764-144-0x00000000063D0000-0x0000000006974000-memory.dmp
memory/105764-145-0x00000000056C0000-0x0000000005752000-memory.dmp
memory/105764-140-0x0000000005800000-0x0000000005E18000-memory.dmp
memory/105764-141-0x0000000005270000-0x0000000005282000-memory.dmp
memory/105764-142-0x00000000053A0000-0x00000000054AA000-memory.dmp
memory/105764-143-0x00000000052D0000-0x000000000530C000-memory.dmp
memory/105764-134-0x0000000000400000-0x000000000041E000-memory.dmp
memory/105764-146-0x0000000005760000-0x00000000057D6000-memory.dmp
memory/105764-147-0x00000000057E0000-0x00000000057FE000-memory.dmp
memory/105764-148-0x0000000006AF0000-0x0000000006B56000-memory.dmp
memory/105764-149-0x0000000006F30000-0x00000000070F2000-memory.dmp
memory/105764-150-0x0000000007630000-0x0000000007B5C000-memory.dmp
memory/105764-151-0x0000000006E60000-0x0000000006EB0000-memory.dmp