Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 15:18
Static task
static1
Behavioral task
behavioral1
Sample
2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe
Resource
win10v2004-20230220-en
General
-
Target
2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe
-
Size
308KB
-
MD5
a30b4635360d9048273e3a1b741dc672
-
SHA1
a58eb314de009e7b135a4b28adf73800d07be723
-
SHA256
2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7
-
SHA512
e55d34c9ead279a8225661f988c1962428d830bd77db30d055372e068b02ba057fcaa13a52e0753d0003e83f42ad39f2d022b51c602ec185b875e181c4a671bc
-
SSDEEP
6144:aJie0RFHhNXwvTygXUNVS4MGh1aBFrvz1xcxcVt8P:aJoRqyR1aBFrvz1xcxy8P
Malware Config
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exedescription pid process target process PID 2640 set thread context of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1300 2640 WerFault.exe 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3524 AppLaunch.exe 3524 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3524 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exedescription pid process target process PID 2640 wrote to memory of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe PID 2640 wrote to memory of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe PID 2640 wrote to memory of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe PID 2640 wrote to memory of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe PID 2640 wrote to memory of 3524 2640 2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe"C:\Users\Admin\AppData\Local\Temp\2927bc846121875589e0e0aef1e2d5e1f4560f2afeac86ef7a1456ebd52655f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 5042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2640 -ip 26401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3524-133-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3524-138-0x000000000B040000-0x000000000B658000-memory.dmpFilesize
6.1MB
-
memory/3524-139-0x000000000ABC0000-0x000000000ACCA000-memory.dmpFilesize
1.0MB
-
memory/3524-140-0x000000000AB00000-0x000000000AB12000-memory.dmpFilesize
72KB
-
memory/3524-141-0x000000000AB60000-0x000000000AB9C000-memory.dmpFilesize
240KB
-
memory/3524-142-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB
-
memory/3524-143-0x000000000AE70000-0x000000000AEE6000-memory.dmpFilesize
472KB
-
memory/3524-144-0x000000000AF90000-0x000000000B022000-memory.dmpFilesize
584KB
-
memory/3524-145-0x000000000AEF0000-0x000000000AF56000-memory.dmpFilesize
408KB
-
memory/3524-146-0x000000000C050000-0x000000000C5F4000-memory.dmpFilesize
5.6MB
-
memory/3524-147-0x000000000BC80000-0x000000000BCD0000-memory.dmpFilesize
320KB
-
memory/3524-148-0x000000000C600000-0x000000000C7C2000-memory.dmpFilesize
1.8MB
-
memory/3524-149-0x000000000CD00000-0x000000000D22C000-memory.dmpFilesize
5.2MB
-
memory/3524-150-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB