Analysis
-
max time kernel
53s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08-06-2023 14:52
Static task
static1
Behavioral task
behavioral1
Sample
83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe
Resource
win10-20230220-en
General
-
Target
83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe
-
Size
308KB
-
MD5
6d1c577203c6e02d2ce5db8722e29d47
-
SHA1
ddbb8eae07460c31fd7ad44ce8aa1756b6dc3f24
-
SHA256
83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d
-
SHA512
7b757735461fc1dc4542068c5f45befab768b3d3040aae2f98eb1409bb8273ee359c44aec9810286291f5765b2ba012dbde23f1a2d95d68e6b2f3410a81ced5a
-
SSDEEP
6144:aJiekRFHLXwvTygXUNVS4MGh1aBFrvz1xcxcVtEP:aJ4RCyR1aBFrvz1xcxyEP
Malware Config
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exedescription pid process target process PID 4052 set thread context of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1560 4052 WerFault.exe 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4264 AppLaunch.exe 4264 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4264 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exedescription pid process target process PID 4052 wrote to memory of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe PID 4052 wrote to memory of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe PID 4052 wrote to memory of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe PID 4052 wrote to memory of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe PID 4052 wrote to memory of 4264 4052 83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe"C:\Users\Admin\AppData\Local\Temp\83444b8034c23a1178ab3f8a8025cd87292760cb549847331e4dd8ec444af05d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 5002⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4264-116-0x0000000000790000-0x00000000007C0000-memory.dmpFilesize
192KB
-
memory/4264-124-0x00000000002F0000-0x00000000002F6000-memory.dmpFilesize
24KB
-
memory/4264-125-0x00000000090B0000-0x00000000096B6000-memory.dmpFilesize
6.0MB
-
memory/4264-126-0x0000000008BB0000-0x0000000008CBA000-memory.dmpFilesize
1.0MB
-
memory/4264-127-0x00000000007C0000-0x00000000007D2000-memory.dmpFilesize
72KB
-
memory/4264-128-0x0000000008470000-0x00000000084AE000-memory.dmpFilesize
248KB
-
memory/4264-129-0x0000000008AA0000-0x0000000008AEB000-memory.dmpFilesize
300KB
-
memory/4264-130-0x0000000008A90000-0x0000000008AA0000-memory.dmpFilesize
64KB
-
memory/4264-147-0x0000000008A90000-0x0000000008AA0000-memory.dmpFilesize
64KB
-
memory/4264-148-0x0000000008DB0000-0x0000000008E26000-memory.dmpFilesize
472KB
-
memory/4264-149-0x0000000008ED0000-0x0000000008F62000-memory.dmpFilesize
584KB
-
memory/4264-150-0x0000000008E30000-0x0000000008E96000-memory.dmpFilesize
408KB
-
memory/4264-151-0x000000000A0D0000-0x000000000A5CE000-memory.dmpFilesize
5.0MB
-
memory/4264-392-0x0000000009A10000-0x0000000009A60000-memory.dmpFilesize
320KB
-
memory/4264-405-0x0000000009EE0000-0x000000000A0A2000-memory.dmpFilesize
1.8MB
-
memory/4264-406-0x000000000BE20000-0x000000000C34C000-memory.dmpFilesize
5.2MB