Analysis

  • max time kernel
    299s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-11-2022 10:53

General

  • Target

    b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe

  • Size

    2.4MB

  • MD5

    9bbd4395f60dcef8bf4031657c36ceb9

  • SHA1

    ebb3de7fa49655d2936cd426dc8b6e6ffeefe1ca

  • SHA256

    b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2

  • SHA512

    4ac276f598907ea851b6caad9adb692ce681e52339d0ac650535bd4fe796795736ebccfa066e4418ab8c9a4acb738bf85f01609a8979677d77cfe33c706b6631

  • SSDEEP

    24576:0b33YaYeUrGq9MI+oXDroMohelJlwHQBHpdJyqAL7ll3RuQ55313g:0ba1RJKwBHpdJyqANl3e

Score
10/10

Malware Config

Extracted

Family

redline

C2

193.124.22.4:39946

Attributes
  • auth_value

    e28bed11265151a1fffbcb26911c9093

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
    "C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:150376

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-122-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/4324-125-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-126-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/150376-131-0x000000000041B4FE-mapping.dmp

    • memory/150376-132-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-133-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-134-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-136-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-135-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-138-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-139-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-141-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-142-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-143-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-144-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-145-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-146-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-147-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-148-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-149-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-150-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-151-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-152-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-153-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-154-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-155-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-156-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-157-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-158-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-159-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-160-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-161-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-162-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-163-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-165-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-166-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-167-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-168-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-169-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-170-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-171-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-172-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-173-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-174-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-175-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-176-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-177-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-178-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-179-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-180-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-181-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-182-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-183-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-184-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-185-0x00000000776D0000-0x000000007785E000-memory.dmp

      Filesize

      1.6MB

    • memory/150376-187-0x0000000009A10000-0x000000000A016000-memory.dmp

      Filesize

      6.0MB

    • memory/150376-188-0x0000000007000000-0x0000000007012000-memory.dmp

      Filesize

      72KB

    • memory/150376-189-0x0000000009510000-0x000000000961A000-memory.dmp

      Filesize

      1.0MB

    • memory/150376-192-0x0000000007060000-0x000000000709E000-memory.dmp

      Filesize

      248KB

    • memory/150376-194-0x0000000009400000-0x000000000944B000-memory.dmp

      Filesize

      300KB