Analysis
-
max time kernel
91s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
1.4MB
-
MD5
34fe5a37c7921bbdaacbd9d6390e5eb9
-
SHA1
69f9c57638e112232d315ef4d85af55151e9be90
-
SHA256
fb510aeb78ac861e75a3d79ee2926d44121eaac29bdfac8878f2cd3cd4c2553a
-
SHA512
a04662319b0385c6b59d4b6011e7e0b6effa73e978026d9d4a9744eae88a3f1d9019fae1a04427b01a134fc24e10947d86ecd9da2506bcb66ee18e4de83e34bd
-
SSDEEP
24576:D71Y1FecMTBP8fVsJzoqmT56nYNk9A0IPkpo6tNOPQBI2WI0aCw28BueGl3ejZvT:mFecANeVsoD5WYO9A7k66tNYQa26aCeV
Malware Config
Extracted
redline
1310
79.137.192.57:48771
-
auth_value
feb5f5c29913f32658637e553762a40e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/97860-133-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4252 set thread context of 97860 4252 file.exe 83 -
Program crash 1 IoCs
pid pid_target Process procid_target 97992 4252 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 97860 AppLaunch.exe 97860 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 97860 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4252 wrote to memory of 97860 4252 file.exe 83 PID 4252 wrote to memory of 97860 4252 file.exe 83 PID 4252 wrote to memory of 97860 4252 file.exe 83 PID 4252 wrote to memory of 97860 4252 file.exe 83 PID 4252 wrote to memory of 97860 4252 file.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:97860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 948002⤵
- Program crash
PID:97992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4252 -ip 42521⤵PID:97892