Analysis

  • max time kernel
    83s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2023 20:09

General

  • Target

    a7587381129a99402b9c9a027fe8ccbe57d10323371728b12b7e72435ac668c5.exe

  • Size

    1MB

  • MD5

    ebadf0b0222d1fbda47585fee0a067fd

  • SHA1

    dc8e03f5291d4007a07a5fd7c3930b626ed17cc1

  • SHA256

    a7587381129a99402b9c9a027fe8ccbe57d10323371728b12b7e72435ac668c5

  • SHA512

    052f86fe5d7fbc2b5af68fcf52e738649a71b88fca7c8583c664b7ffb80e4d6ef94178381aae8de17be68be7871532dd01c465d888a663e7b32bd1bb3a3121ed

  • SSDEEP

    12288:DzrKXmGDS7wmLFawxmd4JLuifxmcSdFVhGb3Sn:DnFawx1BdSdPQa

Malware Config

Extracted

Family

redline

Botnet

1

C2

172.190.158.255:33777

Attributes
  • auth_value

    d39fa9fb8831bf1aeaf33fd4e5714257

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7587381129a99402b9c9a027fe8ccbe57d10323371728b12b7e72435ac668c5.exe
    "C:\Users\Admin\AppData\Local\Temp\a7587381129a99402b9c9a027fe8ccbe57d10323371728b12b7e72435ac668c5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/316-145-0x0000000005790000-0x00000000057A0000-memory.dmp
    Filesize

    64KB

  • memory/316-156-0x0000000074A80000-0x0000000075230000-memory.dmp
    Filesize

    7MB

  • memory/316-146-0x0000000005900000-0x000000000593C000-memory.dmp
    Filesize

    240KB

  • memory/316-154-0x0000000009C10000-0x000000000A13C000-memory.dmp
    Filesize

    5MB

  • memory/316-141-0x0000000074A80000-0x0000000075230000-memory.dmp
    Filesize

    7MB

  • memory/316-142-0x0000000005EC0000-0x00000000064D8000-memory.dmp
    Filesize

    6MB

  • memory/316-143-0x00000000059B0000-0x0000000005ABA000-memory.dmp
    Filesize

    1MB

  • memory/316-144-0x00000000058A0000-0x00000000058B2000-memory.dmp
    Filesize

    72KB

  • memory/316-153-0x0000000009510000-0x00000000096D2000-memory.dmp
    Filesize

    1MB

  • memory/316-134-0x0000000000400000-0x0000000000430000-memory.dmp
    Filesize

    192KB

  • memory/316-148-0x0000000005D30000-0x0000000005DC2000-memory.dmp
    Filesize

    584KB

  • memory/316-147-0x0000000005C10000-0x0000000005C86000-memory.dmp
    Filesize

    472KB

  • memory/316-149-0x0000000006F80000-0x0000000007524000-memory.dmp
    Filesize

    5MB

  • memory/316-150-0x0000000005DD0000-0x0000000005E36000-memory.dmp
    Filesize

    408KB

  • memory/316-151-0x0000000074A80000-0x0000000075230000-memory.dmp
    Filesize

    7MB

  • memory/316-152-0x0000000005790000-0x00000000057A0000-memory.dmp
    Filesize

    64KB

  • memory/4584-135-0x0000000000500000-0x0000000000659000-memory.dmp
    Filesize

    1MB

  • memory/4584-140-0x0000000000500000-0x0000000000659000-memory.dmp
    Filesize

    1MB

  • memory/4584-133-0x0000000000500000-0x0000000000659000-memory.dmp
    Filesize

    1MB