Analysis
-
max time kernel
51s -
max time network
61s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-10-2022 20:02
Static task
static1
Behavioral task
behavioral1
Sample
efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe
Resource
win10-20220812-en
General
-
Target
efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe
-
Size
723KB
-
MD5
8be16556bcd1f7e5e72b0a5516b444bc
-
SHA1
5a4781455921136beb0020cf5b38c12832753855
-
SHA256
efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0
-
SHA512
f66afd0eaa0a611b870bab52e45639c0c76be2c1f4d90036c95eda133eeaf434b0f6fb7467a1f77e21146c32c7b4f23a8057cabd962b4616415133e27220d155
-
SSDEEP
12288:fQfr2Y0TpkxujvEBBmUQEI2yEiThYvTEGJ0wJ69TV6VBuKU64ZvwU7Prs0nab:fQfrT0TpkxuI2EidYbEGJdaVDZ7Q0nY
Malware Config
Extracted
redline
slovarikinstalls
78.153.144.3:2510
-
auth_value
5f80b2ec82e3bd02a08a3a55d3180551
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2336-133-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/2336-138-0x0000000000422146-mapping.dmp family_redline behavioral1/memory/1788-140-0x00000000008B0000-0x0000000000968000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exedescription pid process target process PID 1788 set thread context of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2336 RegSvcs.exe 2336 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2336 RegSvcs.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exedescription pid process target process PID 1788 wrote to memory of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe PID 1788 wrote to memory of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe PID 1788 wrote to memory of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe PID 1788 wrote to memory of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe PID 1788 wrote to memory of 2336 1788 efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe"C:\Users\Admin\AppData\Local\Temp\efc2123d6a527cc11c2e23dacbc2d1a4d6cd8dacc2f329dffeb3b99af9cbf3a0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1788-120-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-121-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-122-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-123-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-124-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-125-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-126-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-127-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-128-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-129-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-130-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-131-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-132-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1788-140-0x00000000008B0000-0x0000000000968000-memory.dmpFilesize
736KB
-
memory/2336-133-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2336-138-0x0000000000422146-mapping.dmp
-
memory/2336-141-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-139-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-142-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-143-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-144-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-145-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-146-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-147-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-148-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-149-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-150-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-151-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-152-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-153-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-154-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-155-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-156-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-157-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-158-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-159-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-160-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-161-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-162-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-163-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-164-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-165-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-166-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-167-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-168-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-169-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-170-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-171-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-172-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-173-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-174-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-175-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-176-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-177-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-178-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-179-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-180-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-181-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-182-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-183-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-184-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-185-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/2336-191-0x0000000005700000-0x0000000005D06000-memory.dmpFilesize
6.0MB
-
memory/2336-192-0x0000000005200000-0x000000000530A000-memory.dmpFilesize
1.0MB
-
memory/2336-194-0x0000000005120000-0x0000000005132000-memory.dmpFilesize
72KB
-
memory/2336-196-0x0000000005180000-0x00000000051BE000-memory.dmpFilesize
248KB
-
memory/2336-198-0x0000000005310000-0x000000000535B000-memory.dmpFilesize
300KB
-
memory/2336-202-0x0000000005500000-0x0000000005592000-memory.dmpFilesize
584KB
-
memory/2336-203-0x0000000006210000-0x000000000670E000-memory.dmpFilesize
5.0MB
-
memory/2336-206-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/2336-214-0x0000000006190000-0x0000000006206000-memory.dmpFilesize
472KB
-
memory/2336-215-0x0000000006110000-0x0000000006160000-memory.dmpFilesize
320KB
-
memory/2336-219-0x0000000007710000-0x00000000078D2000-memory.dmpFilesize
1.8MB
-
memory/2336-220-0x0000000007E10000-0x000000000833C000-memory.dmpFilesize
5.2MB