Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 02:34
Static task
static1
Behavioral task
behavioral1
Sample
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe
Resource
win10v2004-20230220-en
General
-
Target
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe
-
Size
1.0MB
-
MD5
e80944ad1b3d3757b5f097275ff7aa71
-
SHA1
6271aaebc264ba1c6e42c9a7d109270eaeac52ce
-
SHA256
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8
-
SHA512
11284c5d8030114f228e9fe7b73d70f56dbe362c399728284d50b324131579ef049593db4315107a533ee5945b997b77d235ae921a3cd0be44d1b5a038c37dbd
-
SSDEEP
6144:iwZTqmvKC3kd49fAzyym05F7vfbAOsolBoQBV3Kf6Ww5LNZfT3wPY6kuYw:iWqmSOky9fAzTOu46WwL1whpYw
Malware Config
Extracted
redline
vcxz
185.244.181.112:39640
-
auth_value
c3f64556104479e612e28b2f8aaf39e5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exedescription pid process target process PID 2708 set thread context of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1632 2708 WerFault.exe d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 4072 RegSvcs.exe 4072 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4072 RegSvcs.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exedescription pid process target process PID 2708 wrote to memory of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe PID 2708 wrote to memory of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe PID 2708 wrote to memory of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe PID 2708 wrote to memory of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe PID 2708 wrote to memory of 4072 2708 d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe"C:\Users\Admin\AppData\Local\Temp\d322cd714f9a91593e01dfe061b4b6983cf70c4b9e2321dcd45a55ffa79303c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2708 -ip 27081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4072-133-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4072-138-0x00000000056B0000-0x0000000005CC8000-memory.dmpFilesize
6.1MB
-
memory/4072-139-0x0000000005120000-0x0000000005132000-memory.dmpFilesize
72KB
-
memory/4072-140-0x0000000005250000-0x000000000535A000-memory.dmpFilesize
1.0MB
-
memory/4072-141-0x0000000005180000-0x00000000051BC000-memory.dmpFilesize
240KB
-
memory/4072-142-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4072-143-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/4072-144-0x0000000006070000-0x0000000006102000-memory.dmpFilesize
584KB
-
memory/4072-145-0x00000000066C0000-0x0000000006C64000-memory.dmpFilesize
5.6MB
-
memory/4072-146-0x0000000006190000-0x0000000006206000-memory.dmpFilesize
472KB
-
memory/4072-147-0x0000000006130000-0x000000000614E000-memory.dmpFilesize
120KB
-
memory/4072-148-0x00000000064A0000-0x0000000006662000-memory.dmpFilesize
1.8MB
-
memory/4072-149-0x00000000071A0000-0x00000000076CC000-memory.dmpFilesize
5.2MB