Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 07:18
Static task
static1
Behavioral task
behavioral1
Sample
cd7ee7a99ca42119744b7412d0488fa9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cd7ee7a99ca42119744b7412d0488fa9.exe
Resource
win10v2004-20220901-en
General
-
Target
cd7ee7a99ca42119744b7412d0488fa9.exe
-
Size
1.2MB
-
MD5
cd7ee7a99ca42119744b7412d0488fa9
-
SHA1
734f91a23a1589d19deb6910607145f158f8f478
-
SHA256
ad322d1fada253d07e90d48b5c9e7ed6a0fcd12bcc2648df015464da59e66ef0
-
SHA512
cd8c855b492e85390a567057923c56b7a8f2983cc636bd1e43b37e31b5997fc454d28a1def4229dea64dc10a46db343971dc3628ef1ad92dedec8c0821fce72c
-
SSDEEP
24576:egG1BJHjCU9WxVR364yaBb5HlS4ZJZduLUxOdzUqeO1Gh2d36GMJ:dG1v9oX1dyc7JZdu2OaedBM
Malware Config
Extracted
redline
FREE-APPS
amrican-sport-live-stream.cc:4581
-
auth_value
0c9fc6b0cc64520358e3542816da34e2
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cd7ee7a99ca42119744b7412d0488fa9.exedescription pid process target process PID 4572 set thread context of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
InstallUtil.exepid process 4312 InstallUtil.exe 4312 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cd7ee7a99ca42119744b7412d0488fa9.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4572 cd7ee7a99ca42119744b7412d0488fa9.exe Token: SeDebugPrivilege 4312 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cd7ee7a99ca42119744b7412d0488fa9.exedescription pid process target process PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe PID 4572 wrote to memory of 4312 4572 cd7ee7a99ca42119744b7412d0488fa9.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd7ee7a99ca42119744b7412d0488fa9.exe"C:\Users\Admin\AppData\Local\Temp\cd7ee7a99ca42119744b7412d0488fa9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4312-141-0x0000000005920000-0x0000000005932000-memory.dmpFilesize
72KB
-
memory/4312-142-0x0000000005980000-0x00000000059BC000-memory.dmpFilesize
240KB
-
memory/4312-146-0x0000000009EA0000-0x000000000A3CC000-memory.dmpFilesize
5.2MB
-
memory/4312-145-0x0000000009590000-0x0000000009752000-memory.dmpFilesize
1.8MB
-
memory/4312-144-0x0000000006AA0000-0x0000000006AF0000-memory.dmpFilesize
320KB
-
memory/4312-137-0x0000000000000000-mapping.dmp
-
memory/4312-143-0x0000000006C50000-0x0000000006CC6000-memory.dmpFilesize
472KB
-
memory/4312-140-0x0000000005A30000-0x0000000005B3A000-memory.dmpFilesize
1.0MB
-
memory/4312-138-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4312-139-0x0000000005F40000-0x0000000006558000-memory.dmpFilesize
6.1MB
-
memory/4572-132-0x0000000000F30000-0x0000000001074000-memory.dmpFilesize
1.3MB
-
memory/4572-133-0x0000000005E10000-0x0000000005E32000-memory.dmpFilesize
136KB
-
memory/4572-136-0x000000003BC20000-0x000000003C1C4000-memory.dmpFilesize
5.6MB
-
memory/4572-135-0x000000003B5D0000-0x000000003B662000-memory.dmpFilesize
584KB
-
memory/4572-134-0x0000000005F90000-0x0000000005FF6000-memory.dmpFilesize
408KB