Analysis
-
max time kernel
165s -
max time network
181s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
18-11-2022 03:46
Static task
static1
Behavioral task
behavioral1
Sample
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe
Resource
win10-20220812-en
General
-
Target
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe
-
Size
1.2MB
-
MD5
49128d358b90e7110e9f792e247d1db2
-
SHA1
da15de46c60bafa8493f3ebf65c6455230c0f7fb
-
SHA256
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4
-
SHA512
1f524959ef6788adf7da27c2fc847d15b404e740d56f9e92f388e23070f6bb0c8881c08e114590a966d4a0240368bd9dbd423318eac86935845fa85def0bfce4
-
SSDEEP
24576:AyTsIIQSREBz3op/xkIQKHmQGtaduEKq4:AyHSRLxkhVQGyhKq
Malware Config
Extracted
redline
RAMSES
77.73.134.54:19123
-
auth_value
3ba0ecb99f540fa197be387c2d886b1f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2640-198-0x000000000F700000-0x000000000F88A000-memory.dmp family_redline behavioral2/memory/4156-238-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exedescription pid process target process PID 2640 set thread context of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exengentask.exepid process 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe 4156 ngentask.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ngentask.exedescription pid process Token: SeDebugPrivilege 4156 ngentask.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exedescription pid process target process PID 2640 wrote to memory of 4160 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4160 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4160 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe PID 2640 wrote to memory of 4156 2640 4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe ngentask.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe"C:\Users\Admin\AppData\Local\Temp\4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2640-115-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-116-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-117-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-118-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-119-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-131-0x00000000022D0000-0x0000000002803000-memory.dmpFilesize
5.2MB
-
memory/2640-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-158-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-170-0x0000000002B50000-0x0000000002C65000-memory.dmpFilesize
1.1MB
-
memory/2640-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-176-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-182-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-198-0x000000000F700000-0x000000000F88A000-memory.dmpFilesize
1.5MB
-
memory/2640-250-0x00000000022D0000-0x0000000002803000-memory.dmpFilesize
5.2MB
-
memory/4156-238-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4156-273-0x0000000005BA0000-0x00000000061A6000-memory.dmpFilesize
6.0MB
-
memory/4156-274-0x0000000005730000-0x000000000583A000-memory.dmpFilesize
1.0MB
-
memory/4156-277-0x0000000005660000-0x0000000005672000-memory.dmpFilesize
72KB
-
memory/4156-279-0x00000000056D0000-0x000000000570E000-memory.dmpFilesize
248KB
-
memory/4156-281-0x0000000005840000-0x000000000588B000-memory.dmpFilesize
300KB
-
memory/4156-286-0x00000000059E0000-0x0000000005A46000-memory.dmpFilesize
408KB
-
memory/4156-294-0x00000000068D0000-0x0000000006DCE000-memory.dmpFilesize
5.0MB
-
memory/4156-295-0x00000000065B0000-0x0000000006642000-memory.dmpFilesize
584KB
-
memory/4156-297-0x0000000006FA0000-0x0000000007162000-memory.dmpFilesize
1.8MB
-
memory/4156-298-0x00000000076A0000-0x0000000007BCC000-memory.dmpFilesize
5.2MB