Analysis
-
max time kernel
148s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2023 08:13
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftRuntimeComponentsX86.exe
Resource
win7-20220812-en
General
-
Target
MicrosoftRuntimeComponentsX86.exe
-
Size
853.5MB
-
MD5
3fc8c48701df1828c47376ee5df96bd5
-
SHA1
0cf749ecd1750fa50975d7ebc9fecb16d5480337
-
SHA256
735dcf6c201cc373d21f08a4ea4b5d700f25d2a230e4d1fdb1d6514866df61cb
-
SHA512
e3e5e88d50e5d63448f4dcc5501ec6a907c1f77b2482c35a0fe0d416092b5b83cb03b5879d8291db37af8b76d5d72ec0544952dc36f885e00d907903a5dcfd96
-
SSDEEP
24576:6FJ4cp8auK1VOS4JfFm7DTzPCOeuThaPD1:6FJ3pxucOS4bm3HmuT0PD1
Malware Config
Extracted
redline
4
95.217.102.105:1695
-
auth_value
e17158d5fc1b8a0e6865d1b4aed75b6a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
MicrosoftRuntimeComponentsX86.exedescription pid process target process PID 4912 set thread context of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MicrosoftRuntimeComponentsX86.exepid process 4244 MicrosoftRuntimeComponentsX86.exe 4244 MicrosoftRuntimeComponentsX86.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MicrosoftRuntimeComponentsX86.exedescription pid process Token: SeDebugPrivilege 4244 MicrosoftRuntimeComponentsX86.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
MicrosoftRuntimeComponentsX86.exedescription pid process target process PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe PID 4912 wrote to memory of 4244 4912 MicrosoftRuntimeComponentsX86.exe MicrosoftRuntimeComponentsX86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftRuntimeComponentsX86.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftRuntimeComponentsX86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftRuntimeComponentsX86.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftRuntimeComponentsX86.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MicrosoftRuntimeComponentsX86.exe.logFilesize
1KB
MD5400f1cc1a0a0ce1cdabda365ab3368ce
SHA11ecf683f14271d84f3b6063493dce00ff5f42075
SHA256c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
SHA51214c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45
-
memory/4244-144-0x0000000007770000-0x00000000077E6000-memory.dmpFilesize
472KB
-
memory/4244-139-0x0000000005910000-0x0000000005F28000-memory.dmpFilesize
6.1MB
-
memory/4244-147-0x0000000008110000-0x000000000863C000-memory.dmpFilesize
5.2MB
-
memory/4244-146-0x0000000007A10000-0x0000000007BD2000-memory.dmpFilesize
1.8MB
-
memory/4244-141-0x0000000005340000-0x0000000005352000-memory.dmpFilesize
72KB
-
memory/4244-138-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4244-145-0x00000000077F0000-0x0000000007840000-memory.dmpFilesize
320KB
-
memory/4244-140-0x0000000005410000-0x000000000551A000-memory.dmpFilesize
1.0MB
-
memory/4244-137-0x0000000000000000-mapping.dmp
-
memory/4244-142-0x00000000053A0000-0x00000000053DC000-memory.dmpFilesize
240KB
-
memory/4244-143-0x00000000057F0000-0x0000000005856000-memory.dmpFilesize
408KB
-
memory/4912-132-0x00000000002F0000-0x000000000049C000-memory.dmpFilesize
1.7MB
-
memory/4912-134-0x0000000004E90000-0x0000000004F22000-memory.dmpFilesize
584KB
-
memory/4912-136-0x0000000005210000-0x00000000052AC000-memory.dmpFilesize
624KB
-
memory/4912-135-0x0000000004E50000-0x0000000004E5A000-memory.dmpFilesize
40KB
-
memory/4912-133-0x0000000005720000-0x0000000005CC4000-memory.dmpFilesize
5.6MB