Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
13/12/2022, 15:40
General
- Target kiddions mode.exe
- Size 6.5MB
- Sample221213-s364tsfa42
- SHA256 0bc2ab881aec5908ca3db641dbc617f1e1791681b51eac32c49cd6d35c8e8d1b
Malware Config
Extracted
-
redline
-
@s1ker777
-
176.113.115.7:2883
-
auth_value
dd3766491228ea046e9f9c737284a176
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kiddions mode.exe"C:\Users\Admin\AppData\Local\Temp\kiddions mode.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1232-136-0x00007FFF7B960000-0x00007FFF7C421000-memory.dmp
memory/1232-133-0x00007FFF7B960000-0x00007FFF7C421000-memory.dmp
memory/1232-132-0x00000000002B0000-0x0000000000938000-memory.dmp
memory/1488-140-0x0000000004F20000-0x0000000004F5C000-memory.dmp
memory/1488-137-0x0000000005410000-0x0000000005A28000-memory.dmp
memory/1488-138-0x0000000004F90000-0x000000000509A000-memory.dmp
memory/1488-139-0x0000000004EC0000-0x0000000004ED2000-memory.dmp
memory/1488-134-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1488-141-0x0000000005250000-0x00000000052B6000-memory.dmp
memory/1488-142-0x0000000005DD0000-0x0000000005E62000-memory.dmp
memory/1488-143-0x0000000006420000-0x00000000069C4000-memory.dmp
memory/1488-144-0x00000000061A0000-0x0000000006362000-memory.dmp
memory/1488-145-0x0000000006F00000-0x000000000742C000-memory.dmp
memory/1488-146-0x0000000006370000-0x00000000063E6000-memory.dmp
memory/1488-147-0x00000000069D0000-0x0000000006A20000-memory.dmp