Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2023 01:43

General

  • Target

    239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe

  • Size

    335KB

  • MD5

    b5237a3f0b1db945c1fe3f9ba71e3ff2

  • SHA1

    ba302c3c2490a3b1b04cfbdd76097f2444a54700

  • SHA256

    239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2

  • SHA512

    9879c4cd6e995916cbd8cb16f6cb3982b48b0ffc5d01479e2c2f3f73ae46a5129893571f94ded70a0ad61a1340c67ef8214018bbc7e1e17fd5395a4f55fb78a1

  • SSDEEP

    6144:d/sM+uEe4oleWZxrigxyZdXlgdqUh+LoXl4m34fX6Rs+j2exWLsxAFFDwkGklYkv:5sM+uEe30D67j2exWPFxwkiVi

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

1

C2

dexstat255.xyz:46578

Attributes
  • auth_value

    c4805fc19583231a4c5bb64b0e833716

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe
    "C:\Users\Admin\AppData\Local\Temp\239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
        3⤵
          PID:1484
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
          3⤵
            PID:3724

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jacjeknk.2ja.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/884-134-0x0000000005120000-0x00000000056C4000-memory.dmp
        Filesize

        5MB

      • memory/884-135-0x0000000004C50000-0x0000000004CE2000-memory.dmp
        Filesize

        584KB

      • memory/884-136-0x0000000004C10000-0x0000000004C32000-memory.dmp
        Filesize

        136KB

      • memory/884-137-0x0000000004D80000-0x0000000004D90000-memory.dmp
        Filesize

        64KB

      • memory/884-138-0x0000000004D40000-0x0000000004D4A000-memory.dmp
        Filesize

        40KB

      • memory/884-168-0x0000000004D80000-0x0000000004D90000-memory.dmp
        Filesize

        64KB

      • memory/884-133-0x0000000000240000-0x0000000000298000-memory.dmp
        Filesize

        352KB

      • memory/1700-157-0x00000000080B0000-0x000000000872A000-memory.dmp
        Filesize

        6MB

      • memory/1700-139-0x0000000002CE0000-0x0000000002D16000-memory.dmp
        Filesize

        216KB

      • memory/1700-144-0x0000000005FA0000-0x0000000006006000-memory.dmp
        Filesize

        408KB

      • memory/1700-143-0x0000000005E40000-0x0000000005EA6000-memory.dmp
        Filesize

        408KB

      • memory/1700-141-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-154-0x0000000006620000-0x000000000663E000-memory.dmp
        Filesize

        120KB

      • memory/1700-155-0x0000000006A40000-0x0000000006A84000-memory.dmp
        Filesize

        272KB

      • memory/1700-156-0x00000000079B0000-0x0000000007A26000-memory.dmp
        Filesize

        472KB

      • memory/1700-140-0x0000000005770000-0x0000000005D98000-memory.dmp
        Filesize

        6MB

      • memory/1700-159-0x0000000007930000-0x000000000794A000-memory.dmp
        Filesize

        104KB

      • memory/1700-158-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-160-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-161-0x0000000008770000-0x0000000008792000-memory.dmp
        Filesize

        136KB

      • memory/1700-172-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-171-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-170-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-169-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/1700-142-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
        Filesize

        64KB

      • memory/3724-167-0x0000000017CB0000-0x0000000017CEC000-memory.dmp
        Filesize

        240KB

      • memory/3724-166-0x0000000017B60000-0x0000000017B70000-memory.dmp
        Filesize

        64KB

      • memory/3724-165-0x0000000017B40000-0x0000000017B52000-memory.dmp
        Filesize

        72KB

      • memory/3724-164-0x0000000017D80000-0x0000000017E8A000-memory.dmp
        Filesize

        1MB

      • memory/3724-163-0x0000000018290000-0x00000000188A8000-memory.dmp
        Filesize

        6MB

      • memory/3724-162-0x0000000000400000-0x0000000000430000-memory.dmp
        Filesize

        192KB

      • memory/3724-174-0x0000000017B60000-0x0000000017B70000-memory.dmp
        Filesize

        64KB