Analysis
-
max time kernel
60s -
max time network
81s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2023 01:00
Static task
static1
Behavioral task
behavioral1
Sample
3950c1e15b18007b3ee172a178fda0f8.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
3950c1e15b18007b3ee172a178fda0f8.exe
Resource
win10v2004-20230621-en
General
-
Target
3950c1e15b18007b3ee172a178fda0f8.exe
-
Size
151KB
-
MD5
3950c1e15b18007b3ee172a178fda0f8
-
SHA1
73345e1d1f324d93874e7de3bde75528ca30983c
-
SHA256
8ec6230482badb0211902e2d2e563a9b878f47ba7ff4fa22c4bbb15426a9a99c
-
SHA512
9575cca3db94074c1acd59c4aa7bf41663f6db16bd3b61a13cc767ac3a2d841323d285102a3807c6a7387cc49690ddea78dd0692dee14717693d3144089ad7ad
-
SSDEEP
3072:mgGJB5QpCwS40nLbL7kRDzz8LhAsT+Egm:mgIBOpCLXL7kZz8Cm
Malware Config
Extracted
redline
Mastif
78.47.242.225:15635
-
auth_value
32b21fb55370c8e21f0f75577471534e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 18 4956 powershell.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
Processes:
powershell.exepid process 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4956 set thread context of 5020 4956 powershell.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 4956 powershell.exe Token: SeShutdownPrivilege 4956 powershell.exe Token: SeCreatePagefilePrivilege 4956 powershell.exe Token: SeDebugPrivilege 5020 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3950c1e15b18007b3ee172a178fda0f8.exepowershell.exedescription pid process target process PID 4664 wrote to memory of 4956 4664 3950c1e15b18007b3ee172a178fda0f8.exe powershell.exe PID 4664 wrote to memory of 4956 4664 3950c1e15b18007b3ee172a178fda0f8.exe powershell.exe PID 4664 wrote to memory of 4956 4664 3950c1e15b18007b3ee172a178fda0f8.exe powershell.exe PID 4956 wrote to memory of 4860 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 4860 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 4860 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe PID 4956 wrote to memory of 5020 4956 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3950c1e15b18007b3ee172a178fda0f8.exe"C:\Users\Admin\AppData\Local\Temp\3950c1e15b18007b3ee172a178fda0f8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsazunzf.zwo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4664-134-0x0000000009AE0000-0x000000000A084000-memory.dmpFilesize
5.6MB
-
memory/4664-135-0x0000000009470000-0x0000000009502000-memory.dmpFilesize
584KB
-
memory/4664-136-0x0000000009690000-0x00000000096A0000-memory.dmpFilesize
64KB
-
memory/4664-137-0x0000000009620000-0x000000000962A000-memory.dmpFilesize
40KB
-
memory/4664-162-0x0000000009690000-0x00000000096A0000-memory.dmpFilesize
64KB
-
memory/4664-133-0x0000000000070000-0x0000000004AB6000-memory.dmpFilesize
74.3MB
-
memory/4956-159-0x0000000007020000-0x000000000703A000-memory.dmpFilesize
104KB
-
memory/4956-170-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-142-0x0000000004E30000-0x0000000004E52000-memory.dmpFilesize
136KB
-
memory/4956-140-0x0000000004F00000-0x0000000005528000-memory.dmpFilesize
6.2MB
-
memory/4956-143-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/4956-149-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/4956-154-0x0000000005CA0000-0x0000000005CBE000-memory.dmpFilesize
120KB
-
memory/4956-155-0x0000000006210000-0x0000000006254000-memory.dmpFilesize
272KB
-
memory/4956-156-0x0000000006F80000-0x0000000006FF6000-memory.dmpFilesize
472KB
-
memory/4956-157-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-158-0x0000000007680000-0x0000000007CFA000-memory.dmpFilesize
6.5MB
-
memory/4956-138-0x0000000002360000-0x0000000002396000-memory.dmpFilesize
216KB
-
memory/4956-160-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-161-0x0000000007DE0000-0x0000000007E02000-memory.dmpFilesize
136KB
-
memory/4956-139-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-179-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-175-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-141-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/4956-169-0x00000000048C0000-0x00000000048D0000-memory.dmpFilesize
64KB
-
memory/5020-167-0x00000000178E0000-0x000000001791C000-memory.dmpFilesize
240KB
-
memory/5020-168-0x0000000017930000-0x0000000017940000-memory.dmpFilesize
64KB
-
memory/5020-166-0x00000000179B0000-0x0000000017ABA000-memory.dmpFilesize
1.0MB
-
memory/5020-164-0x0000000017E00000-0x0000000018418000-memory.dmpFilesize
6.1MB
-
memory/5020-171-0x000000001A000000-0x000000001A1C2000-memory.dmpFilesize
1.8MB
-
memory/5020-172-0x000000001A700000-0x000000001AC2C000-memory.dmpFilesize
5.2MB
-
memory/5020-173-0x0000000019E90000-0x0000000019EAE000-memory.dmpFilesize
120KB
-
memory/5020-174-0x00000000193F0000-0x0000000019440000-memory.dmpFilesize
320KB
-
memory/5020-165-0x0000000017880000-0x0000000017892000-memory.dmpFilesize
72KB
-
memory/5020-163-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB