Analysis
-
max time kernel
299s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01-11-2022 10:53
Static task
static1
Behavioral task
behavioral1
Sample
b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
Resource
win10-20220812-en
General
-
Target
b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
-
Size
2.4MB
-
MD5
9bbd4395f60dcef8bf4031657c36ceb9
-
SHA1
ebb3de7fa49655d2936cd426dc8b6e6ffeefe1ca
-
SHA256
b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2
-
SHA512
4ac276f598907ea851b6caad9adb692ce681e52339d0ac650535bd4fe796795736ebccfa066e4418ab8c9a4acb738bf85f01609a8979677d77cfe33c706b6631
-
SSDEEP
24576:0b33YaYeUrGq9MI+oXDroMohelJlwHQBHpdJyqAL7ll3RuQ55313g:0ba1RJKwBHpdJyqANl3e
Malware Config
Extracted
redline
193.124.22.4:39946
-
auth_value
e28bed11265151a1fffbcb26911c9093
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/memory/150376-126-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/150376-131-0x000000000041B4FE-mapping.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4324 set thread context of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4324 wrote to memory of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67 PID 4324 wrote to memory of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67 PID 4324 wrote to memory of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67 PID 4324 wrote to memory of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67 PID 4324 wrote to memory of 150376 4324 b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe"C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:150376
-