Analysis
-
max time kernel
57s -
max time network
65s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08-06-2023 14:57
Static task
static1
Behavioral task
behavioral1
Sample
4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe
Resource
win10-20230220-en
General
-
Target
4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe
-
Size
308KB
-
MD5
211cd120593c674704987d62389f6632
-
SHA1
ea5ec8db696e7527cd33b643820e1818e228d341
-
SHA256
4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83
-
SHA512
0d1221d570a0c8ec8e0d50bee282a2641a91ca8618a7ad9b6fd8244b298a7c5610635e8246bd1022a44151364353249cf265a162e9cc03b7128fc8a99fe6ba71
-
SSDEEP
6144:zJieURFHllXwvTygXUNVS4MGh1aBFrvz1xcxcVtPP:zJIRCyR1aBFrvz1xcxyPP
Malware Config
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exedescription pid process target process PID 2440 set thread context of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3980 2440 WerFault.exe 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2816 AppLaunch.exe 2816 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2816 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exedescription pid process target process PID 2440 wrote to memory of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe PID 2440 wrote to memory of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe PID 2440 wrote to memory of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe PID 2440 wrote to memory of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe PID 2440 wrote to memory of 2816 2440 4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe"C:\Users\Admin\AppData\Local\Temp\4cba86085d4be0c9ecaea85eaaa49e8e7c5f14452371e81b0d0ed4832fa1fc83.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1442⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2816-121-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2816-129-0x0000000004DB0000-0x0000000004DB6000-memory.dmpFilesize
24KB
-
memory/2816-130-0x0000000009430000-0x0000000009A36000-memory.dmpFilesize
6.0MB
-
memory/2816-131-0x0000000008F30000-0x000000000903A000-memory.dmpFilesize
1.0MB
-
memory/2816-132-0x0000000008DF0000-0x0000000008E02000-memory.dmpFilesize
72KB
-
memory/2816-133-0x0000000008E60000-0x0000000008E9E000-memory.dmpFilesize
248KB
-
memory/2816-134-0x0000000008EA0000-0x0000000008EEB000-memory.dmpFilesize
300KB
-
memory/2816-135-0x0000000008E10000-0x0000000008E20000-memory.dmpFilesize
64KB
-
memory/2816-140-0x0000000009170000-0x00000000091E6000-memory.dmpFilesize
472KB
-
memory/2816-141-0x0000000009290000-0x0000000009322000-memory.dmpFilesize
584KB
-
memory/2816-142-0x000000000A450000-0x000000000A94E000-memory.dmpFilesize
5.0MB
-
memory/2816-143-0x0000000009330000-0x0000000009396000-memory.dmpFilesize
408KB
-
memory/2816-146-0x0000000009D90000-0x0000000009DE0000-memory.dmpFilesize
320KB
-
memory/2816-401-0x000000000A950000-0x000000000AB12000-memory.dmpFilesize
1.8MB
-
memory/2816-402-0x000000000C6D0000-0x000000000CBFC000-memory.dmpFilesize
5.2MB
-
memory/2816-403-0x0000000008E10000-0x0000000008E20000-memory.dmpFilesize
64KB