Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2022 20:02

General

  • Target

    ApplicationSetup.exe

  • Size

    128.0MB

  • MD5

    60ee531549f1d8f40c947c1c25de708c

  • SHA1

    893bf49b923eefe5623e8911e574a3f0f9b0f06d

  • SHA256

    6cbd68a14bf5c477faf6386b8d26c56595fed4e2a8acb66541d389fdd466b7cf

  • SHA512

    af9811505c205f3aafe7fd5261c5753898a2e977750e8b0cdc8543978fedb41a2ab1d553bdc85cffa8b78bc4b699dc971ab01f0eaa847251115433985e02e96a

  • SSDEEP

    196608:TPQ0KH/r+HRLsZdZw8JuOVGJRudWwTBh7wiMBQFOHS3nvSBrlY8L7e5D2OmtUrhy:6S+S

Malware Config

Extracted

Family

redline

Botnet

071222_youtube

C2

newmeta.makelog.org:10737

Attributes
  • auth_value

    34d206cebf0fe398e291ff8c20b37b37

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ApplicationSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ApplicationSetup.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1416

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1416-138-0x00000000051F0000-0x00000000052FA000-memory.dmp

    Filesize

    1.0MB

  • memory/1416-140-0x00000000061F0000-0x0000000006794000-memory.dmp

    Filesize

    5.6MB

  • memory/1416-134-0x0000000000000000-mapping.dmp

  • memory/1416-135-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1416-136-0x0000000005620000-0x0000000005C38000-memory.dmp

    Filesize

    6.1MB

  • memory/1416-137-0x00000000050C0000-0x00000000050D2000-memory.dmp

    Filesize

    72KB

  • memory/1416-145-0x0000000002A10000-0x0000000002A2E000-memory.dmp

    Filesize

    120KB

  • memory/1416-144-0x0000000006C90000-0x0000000006D06000-memory.dmp

    Filesize

    472KB

  • memory/1416-142-0x00000000077C0000-0x0000000007982000-memory.dmp

    Filesize

    1.8MB

  • memory/1416-141-0x0000000005580000-0x00000000055E6000-memory.dmp

    Filesize

    408KB

  • memory/1416-139-0x0000000005120000-0x000000000515C000-memory.dmp

    Filesize

    240KB

  • memory/1416-143-0x0000000007EC0000-0x00000000083EC000-memory.dmp

    Filesize

    5.2MB

  • memory/3848-132-0x0000000000550000-0x0000000000694000-memory.dmp

    Filesize

    1.3MB

  • memory/3848-133-0x0000000005010000-0x00000000050A2000-memory.dmp

    Filesize

    584KB