Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 02:22
Static task
static1
Behavioral task
behavioral1
Sample
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
Resource
win10v2004-20230221-en
General
-
Target
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe
-
Size
304KB
-
MD5
cbe8af1bd5f5737ee10311bf3b2009c4
-
SHA1
1dcd3aa218231f7a76db330c39abaf56d35a0c26
-
SHA256
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f
-
SHA512
4e3e0337c6de5d0be5514266fbedfeb577d3c684277e2d2692ad73a459fee4695479f383697e517eab9dd24f9fe7692e4d84813b12b2e843a79c2c4f0c4d4a16
-
SSDEEP
6144:DJiaQVtzlRba+Y0P0imtipjXkhoyXlVwXCcetePH:DJ4VN40ZXkhoyXlVwXCNePH
Malware Config
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exedescription pid process target process PID 4256 set thread context of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 568 4256 WerFault.exe 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3240 AppLaunch.exe 3240 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3240 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exedescription pid process target process PID 4256 wrote to memory of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 4256 wrote to memory of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 4256 wrote to memory of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 4256 wrote to memory of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe PID 4256 wrote to memory of 3240 4256 06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe"C:\Users\Admin\AppData\Local\Temp\06a152194976346ea573394df32e58244ec5f1d9f97008d1fd69ae7146f47c4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 1642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4256 -ip 42561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3240-133-0x0000000000350000-0x0000000000380000-memory.dmpFilesize
192KB
-
memory/3240-138-0x0000000005420000-0x0000000005A38000-memory.dmpFilesize
6.1MB
-
memory/3240-139-0x0000000004F10000-0x000000000501A000-memory.dmpFilesize
1.0MB
-
memory/3240-140-0x00000000047F0000-0x0000000004802000-memory.dmpFilesize
72KB
-
memory/3240-141-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3240-142-0x0000000004DB0000-0x0000000004DEC000-memory.dmpFilesize
240KB
-
memory/3240-143-0x00000000050A0000-0x0000000005116000-memory.dmpFilesize
472KB
-
memory/3240-144-0x00000000051C0000-0x0000000005252000-memory.dmpFilesize
584KB
-
memory/3240-145-0x00000000064E0000-0x0000000006A84000-memory.dmpFilesize
5.6MB
-
memory/3240-146-0x0000000005260000-0x00000000052C6000-memory.dmpFilesize
408KB
-
memory/3240-147-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3240-148-0x0000000006270000-0x0000000006432000-memory.dmpFilesize
1.8MB
-
memory/3240-149-0x00000000086B0000-0x0000000008BDC000-memory.dmpFilesize
5.2MB
-
memory/3240-150-0x0000000006170000-0x00000000061C0000-memory.dmpFilesize
320KB