Analysis
-
max time kernel
100s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2023 19:17
Static task
static1
Behavioral task
behavioral1
Sample
a45e6fa02ca2dbeeb23d6fff96436a97.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a45e6fa02ca2dbeeb23d6fff96436a97.exe
Resource
win10v2004-20220812-en
General
-
Target
a45e6fa02ca2dbeeb23d6fff96436a97.exe
-
Size
3.7MB
-
MD5
a45e6fa02ca2dbeeb23d6fff96436a97
-
SHA1
61ffee4cb8d28ca05b20076a5ba92aff99449ba7
-
SHA256
bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
-
SHA512
aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707
-
SSDEEP
98304:sBuzuXKMr2WYU68OdYIebQ4kUny6yuuhk6R1J3bj+:h63TO8K6ypk6fRby
Malware Config
Extracted
redline
st1
librchichelpai.shop:81
rniwondunuifac.shop:81
-
auth_value
a7232a45d6034ee2454fc434093d8f12
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a45e6fa02ca2dbeeb23d6fff96436a97.exedescription pid process target process PID 2592 set thread context of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4160 AppLaunch.exe 4160 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4160 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
a45e6fa02ca2dbeeb23d6fff96436a97.exedescription pid process target process PID 2592 wrote to memory of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe PID 2592 wrote to memory of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe PID 2592 wrote to memory of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe PID 2592 wrote to memory of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe PID 2592 wrote to memory of 4160 2592 a45e6fa02ca2dbeeb23d6fff96436a97.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a45e6fa02ca2dbeeb23d6fff96436a97.exe"C:\Users\Admin\AppData\Local\Temp\a45e6fa02ca2dbeeb23d6fff96436a97.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2592-132-0x0000000000490000-0x0000000000A26000-memory.dmpFilesize
5.6MB
-
memory/4160-134-0x0000000000000000-mapping.dmp
-
memory/4160-135-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4160-140-0x0000000005590000-0x0000000005BA8000-memory.dmpFilesize
6.1MB
-
memory/4160-141-0x0000000005080000-0x000000000518A000-memory.dmpFilesize
1.0MB
-
memory/4160-142-0x0000000004F70000-0x0000000004F82000-memory.dmpFilesize
72KB
-
memory/4160-143-0x0000000004FD0000-0x000000000500C000-memory.dmpFilesize
240KB
-
memory/4160-144-0x0000000006310000-0x00000000063A2000-memory.dmpFilesize
584KB
-
memory/4160-145-0x0000000006960000-0x0000000006F04000-memory.dmpFilesize
5.6MB
-
memory/4160-146-0x0000000006490000-0x00000000064F6000-memory.dmpFilesize
408KB
-
memory/4160-147-0x0000000006F10000-0x00000000070D2000-memory.dmpFilesize
1.8MB
-
memory/4160-148-0x0000000007610000-0x0000000007B3C000-memory.dmpFilesize
5.2MB