Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2023 19:21

General

  • Target

    3ad366b1f91d3b4837b5df220612a06b.exe

  • Size

    991KB

  • MD5

    3ad366b1f91d3b4837b5df220612a06b

  • SHA1

    9db9c2b3bcaf91490dbadcd92e58d7ea9126a636

  • SHA256

    6a4e611067897fb1deef968b156672bfb0bb4098c9bcc65d1fbbd7cf24a656ad

  • SHA512

    dda9a7c28305f11c1cde6eb7dfa61c44ed64200a7d4ce0f503899f1b0607bd3b0fca256b3231430d926c84ba10101ef7af8627e0e69299ef400831ad74ebbe32

  • SSDEEP

    12288:LfWyu528tXTCceAzbGmCzMPFHp9k1cKzb5yPcVfGLxBgQW57PNiLsNuXJHsGX0o3:E629k6KzbgPWfGLxB6576lEoI/xQX3R7

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ad366b1f91d3b4837b5df220612a06b.exe
    "C:\Users\Admin\AppData\Local\Temp\3ad366b1f91d3b4837b5df220612a06b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3972

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3756-133-0x0000000000AA0000-0x0000000000B9C000-memory.dmp

    Filesize

    1008KB

  • memory/3756-134-0x00000000055E0000-0x000000000567C000-memory.dmp

    Filesize

    624KB

  • memory/3756-136-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-135-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-138-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-140-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-142-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-144-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-146-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-148-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-150-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-152-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-154-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-156-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-158-0x0000000002F90000-0x0000000002FA5000-memory.dmp

    Filesize

    84KB

  • memory/3756-159-0x00000000055D0000-0x00000000055E0000-memory.dmp

    Filesize

    64KB

  • memory/3756-160-0x00000000055B0000-0x00000000055B1000-memory.dmp

    Filesize

    4KB

  • memory/3972-161-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/3972-163-0x0000000008240000-0x00000000087E4000-memory.dmp

    Filesize

    5.6MB

  • memory/3972-164-0x0000000007D30000-0x0000000007DC2000-memory.dmp

    Filesize

    584KB

  • memory/3972-165-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

    Filesize

    40KB

  • memory/3972-166-0x0000000008E10000-0x0000000009428000-memory.dmp

    Filesize

    6.1MB

  • memory/3972-167-0x0000000007F10000-0x0000000007F22000-memory.dmp

    Filesize

    72KB

  • memory/3972-168-0x00000000080E0000-0x00000000081EA000-memory.dmp

    Filesize

    1.0MB

  • memory/3972-169-0x0000000007F70000-0x0000000007FAC000-memory.dmp

    Filesize

    240KB

  • memory/3972-170-0x0000000007EE0000-0x0000000007EF0000-memory.dmp

    Filesize

    64KB

  • memory/3972-171-0x0000000008860000-0x00000000088C6000-memory.dmp

    Filesize

    408KB

  • memory/3972-172-0x00000000096B0000-0x0000000009726000-memory.dmp

    Filesize

    472KB

  • memory/3972-173-0x0000000009650000-0x000000000966E000-memory.dmp

    Filesize

    120KB

  • memory/3972-174-0x000000000A670000-0x000000000A832000-memory.dmp

    Filesize

    1.8MB

  • memory/3972-175-0x000000000AD70000-0x000000000B29C000-memory.dmp

    Filesize

    5.2MB