Analysis

  • max time kernel
    53s
  • max time network
    75s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/06/2023, 00:17

General

  • Target

    2a071fd7e5c6344f0d9dcdff4f8b0aa8a23e46795df6359260ecf6b1ed6d832a.exe

  • Size

    282KB

  • MD5

    29a1ffa46dd13725a0307d5ae8127033

  • SHA1

    f5d91ae67f86aaba34629095078e043e108d6898

  • SHA256

    2a071fd7e5c6344f0d9dcdff4f8b0aa8a23e46795df6359260ecf6b1ed6d832a

  • SHA512

    74032f6e0d8b4c3d856165c05239c353178db9c5ce33b13feceb4ea02c9b286b54c4476a37238f861314eef56c9fb7a2b37854ab861e8612052d947b9eb97f33

  • SSDEEP

    6144:rQvoWvJfoZuwvTygXUNVS4MGh1aBFrvz1xcxcWh9rt:rUO/yR1aBFrvz1xcxd9rt

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a071fd7e5c6344f0d9dcdff4f8b0aa8a23e46795df6359260ecf6b1ed6d832a.exe
    "C:\Users\Admin\AppData\Local\Temp\2a071fd7e5c6344f0d9dcdff4f8b0aa8a23e46795df6359260ecf6b1ed6d832a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:60
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 140
      2⤵
      • Program crash
      PID:980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/60-120-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/60-128-0x0000000005110000-0x0000000005116000-memory.dmp

    Filesize

    24KB

  • memory/60-129-0x00000000095C0000-0x0000000009BC6000-memory.dmp

    Filesize

    6.0MB

  • memory/60-130-0x00000000090C0000-0x00000000091CA000-memory.dmp

    Filesize

    1.0MB

  • memory/60-131-0x0000000008FF0000-0x0000000009002000-memory.dmp

    Filesize

    72KB

  • memory/60-132-0x0000000009050000-0x000000000908E000-memory.dmp

    Filesize

    248KB

  • memory/60-133-0x00000000091D0000-0x000000000921B000-memory.dmp

    Filesize

    300KB

  • memory/60-134-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/60-139-0x0000000009370000-0x00000000093E6000-memory.dmp

    Filesize

    472KB

  • memory/60-140-0x0000000009490000-0x0000000009522000-memory.dmp

    Filesize

    584KB

  • memory/60-141-0x00000000093F0000-0x0000000009456000-memory.dmp

    Filesize

    408KB

  • memory/60-142-0x000000000A6E0000-0x000000000ABDE000-memory.dmp

    Filesize

    5.0MB

  • memory/60-391-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/60-396-0x000000000A4B0000-0x000000000A672000-memory.dmp

    Filesize

    1.8MB

  • memory/60-397-0x000000000C860000-0x000000000CD8C000-memory.dmp

    Filesize

    5.2MB

  • memory/60-512-0x000000000A430000-0x000000000A480000-memory.dmp

    Filesize

    320KB