Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
02-08-2023 10:11
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
2.8MB
-
MD5
1d156981b23a1531d4e6449c95ec6c9f
-
SHA1
98c264b55efdd118215190955d3a6372e4497330
-
SHA256
223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e
-
SHA512
c2cc592a3b4aef17e1a6882f97e36bc3cc257b6c83b21cc72bd92cf45ff48c5de45c22c34352a10bf3fc66a884dfb8fec007781561be88e9071d6a2433f91a2d
-
SSDEEP
49152:OS6hBcbHH6ORsof+ZymfCvKa+nxzsA/y8aiPRmN6VLvOjwsDxA:OS+BcHaORvmZJfdxIA/y83PcNcLvSwsi
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
300723_rc
C2
rc3007.tuktuk.ug:11290
Attributes
-
auth_value
ce139e531e6dc9a5397038679a0625d3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
resource yara_rule behavioral1/memory/2904-67-0x0000000000FF0000-0x0000000001694000-memory.dmp themida behavioral1/memory/2904-111-0x0000000000FF0000-0x0000000001694000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2904 tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2904 set thread context of 2180 2904 tmp.exe 28 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2904 tmp.exe 2180 AppLaunch.exe 2180 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2904 tmp.exe Token: SeDebugPrivilege 2180 AppLaunch.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28 PID 2904 wrote to memory of 2180 2904 tmp.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-