Analysis
-
max time kernel
29s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-06-2023 02:22
Static task
static1
Behavioral task
behavioral1
Sample
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
Resource
win10v2004-20230221-en
General
-
Target
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
-
Size
304KB
-
MD5
cbe8af1bd5f5737ee10311bf3b2009c4
-
SHA1
1dcd3aa218231f7a76db330c39abaf56d35a0c26
-
SHA256
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f
-
SHA512
4e3e0337c6de5d0be5514266fbedfeb577d3c684277e2d2692ad73a459fee4695479f383697e517eab9dd24f9fe7692e4d84813b12b2e843a79c2c4f0c4d4a16
-
SSDEEP
6144:DJiaQVtzlRba+Y0P0imtipjXkhoyXlVwXCcetePH:DJ4VN40ZXkhoyXlVwXCNePH
Malware Config
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exedescription pid process target process PID 1324 set thread context of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 1732 AppLaunch.exe 1732 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1732 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exedescription pid process target process PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 1324 wrote to memory of 1732 1324 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe"C:\Users\Admin\AppData\Local\Temp\06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-54-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1732-55-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1732-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1732-61-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1732-62-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1732-63-0x0000000000510000-0x0000000000516000-memory.dmpFilesize
24KB
-
memory/1732-64-0x0000000004A80000-0x0000000004AC0000-memory.dmpFilesize
256KB