Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 06:31
Static task
static1
Behavioral task
behavioral1
Sample
b27e75867100b7f34b35cf147b7ce92e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b27e75867100b7f34b35cf147b7ce92e.exe
Resource
win10v2004-20221111-en
General
-
Target
b27e75867100b7f34b35cf147b7ce92e.exe
-
Size
1.2MB
-
MD5
b27e75867100b7f34b35cf147b7ce92e
-
SHA1
e1b51e321d8a5595cc0382198a6ab34c98924194
-
SHA256
7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e
-
SHA512
b71ba509772548d94d7a31685527f454ffc12380fa1537ef133140ece9f67d9070d21497b5694adbe405c528bb83266409053f754a437cde9caf361797318773
-
SSDEEP
24576:H1qOg/vTimfbpDY0aV9+rOL54vwe7r9MCdoavl30Og:zgHGmfbp+V9fqvwe7r9MOl
Malware Config
Extracted
redline
TPB
amrican-sport-live-stream.cc:4581
-
auth_value
9af3f668d2aa93965a3f83753e8ccb3f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b27e75867100b7f34b35cf147b7ce92e.exedescription pid process target process PID 1080 set thread context of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
InstallUtil.exepid process 1584 InstallUtil.exe 1584 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b27e75867100b7f34b35cf147b7ce92e.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1080 b27e75867100b7f34b35cf147b7ce92e.exe Token: SeDebugPrivilege 1584 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b27e75867100b7f34b35cf147b7ce92e.exedescription pid process target process PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe PID 1080 wrote to memory of 1584 1080 b27e75867100b7f34b35cf147b7ce92e.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b27e75867100b7f34b35cf147b7ce92e.exe"C:\Users\Admin\AppData\Local\Temp\b27e75867100b7f34b35cf147b7ce92e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-132-0x00000000000A0000-0x00000000001E2000-memory.dmpFilesize
1.3MB
-
memory/1080-133-0x0000000004F90000-0x0000000004FB2000-memory.dmpFilesize
136KB
-
memory/1080-134-0x0000000005100000-0x0000000005166000-memory.dmpFilesize
408KB
-
memory/1080-135-0x0000000035820000-0x00000000358B2000-memory.dmpFilesize
584KB
-
memory/1080-136-0x0000000035E70000-0x0000000036414000-memory.dmpFilesize
5.6MB
-
memory/1584-137-0x0000000000000000-mapping.dmp
-
memory/1584-138-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1584-139-0x000000000AED0000-0x000000000B4E8000-memory.dmpFilesize
6.1MB
-
memory/1584-140-0x000000000AA50000-0x000000000AB5A000-memory.dmpFilesize
1.0MB
-
memory/1584-141-0x000000000A980000-0x000000000A992000-memory.dmpFilesize
72KB
-
memory/1584-142-0x000000000A9E0000-0x000000000AA1C000-memory.dmpFilesize
240KB
-
memory/1584-143-0x000000000C150000-0x000000000C1C6000-memory.dmpFilesize
472KB
-
memory/1584-144-0x000000000C1D0000-0x000000000C220000-memory.dmpFilesize
320KB
-
memory/1584-145-0x000000000C4F0000-0x000000000C6B2000-memory.dmpFilesize
1.8MB
-
memory/1584-146-0x000000000D230000-0x000000000D75C000-memory.dmpFilesize
5.2MB