Analysis
- max time kernel
185s - max time network
189s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
01/12/2022, 12:23
General
- Target Apocalypse Launcher 0.24.exe
- Size 4.2MB
- Sample221201-pkg57sbb51
- SHA256 90b902a384f7b3da868569a30cbebf140a895fcf028653dfbfb90f5fa6d0d21e
Malware Config
Extracted
-
redline
-
pro
-
79.137.199.206:45354
-
auth_value
e20e8d1492a37ff0cfab3cd3f6c60362
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Apocalypse Launcher 0.24.exe"C:\Users\Admin\AppData\Local\Temp\Apocalypse Launcher 0.24.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1716-132-0x0000000000500000-0x0000000000B83000-memory.dmp
memory/4056-136-0x0000000000700000-0x0000000000736000-memory.dmp
memory/4056-137-0x0000000005130000-0x0000000005748000-memory.dmp
memory/4056-138-0x0000000004BA0000-0x0000000004BB2000-memory.dmp
memory/4056-139-0x0000000004CD0000-0x0000000004DDA000-memory.dmp
memory/4056-140-0x0000000004C00000-0x0000000004C3C000-memory.dmp
memory/4056-141-0x0000000005D00000-0x00000000062A4000-memory.dmp
memory/4056-142-0x0000000005930000-0x00000000059C2000-memory.dmp
memory/4056-143-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/4056-144-0x0000000007130000-0x00000000072F2000-memory.dmp
memory/4056-145-0x0000000007830000-0x0000000007D5C000-memory.dmp