Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-06-2023 09:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
575KB
-
MD5
7e1c47ca9cef11631ddd096c1d3639c7
-
SHA1
4e8d9b1efb8b4b7b316e5a7fd3fb808e2da759a8
-
SHA256
02c640ef3ac9d7fa8c919b0f72bb85413ef3e9803d2d091277b9a7c41f52e9d9
-
SHA512
fa029905bf1921ab433f949167e64874e5da3e98908da38c92ae8e4db987a6ab786f68942993e34c92f713d7bf701e4d066da9abde7b88b6ff018663ba79490a
-
SSDEEP
6144:qTov37S4OHn8MDIYKReFMjkyI/VYXVhUYbjDyVlQBCVTI:qcv37SajRVjziVq3gVlsCVT
Malware Config
Extracted
redline
2
95.216.249.153:81
-
auth_value
101013a5e99e0857595aae297a11351d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 2012 set thread context of 1964 2012 file.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 868 2012 WerFault.exe file.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 1964 AppLaunch.exe 1964 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1964 AppLaunch.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
file.exedescription pid process target process PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 1964 2012 file.exe AppLaunch.exe PID 2012 wrote to memory of 868 2012 file.exe WerFault.exe PID 2012 wrote to memory of 868 2012 file.exe WerFault.exe PID 2012 wrote to memory of 868 2012 file.exe WerFault.exe PID 2012 wrote to memory of 868 2012 file.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 962⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1964-54-0x00000000000D0000-0x0000000000100000-memory.dmpFilesize
192KB
-
memory/1964-55-0x00000000000D0000-0x0000000000100000-memory.dmpFilesize
192KB
-
memory/1964-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1964-61-0x00000000000D0000-0x0000000000100000-memory.dmpFilesize
192KB
-
memory/1964-62-0x00000000000D0000-0x0000000000100000-memory.dmpFilesize
192KB
-
memory/1964-63-0x0000000000350000-0x0000000000356000-memory.dmpFilesize
24KB
-
memory/1964-64-0x0000000000910000-0x0000000000950000-memory.dmpFilesize
256KB
-
memory/1964-65-0x0000000000910000-0x0000000000950000-memory.dmpFilesize
256KB