Analysis
- max time kernel
144s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
04/08/2023, 17:56
General
- Target file.exe
- Size 2.5MB
- Sample230804-wh1cbsef5x
- SHA256 23fbee8f0fc05dc38f50f341c80cd5f5f40e9d546b8f7a3e3ddf3608322f78b9
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4572 -ip 45721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4572-133-0x0000000000B40000-0x0000000000E0F000-memory.dmp
memory/4572-134-0x0000000000B40000-0x0000000000E0F000-memory.dmp
memory/4572-135-0x0000000000B40000-0x0000000000E0F000-memory.dmp
memory/4648-136-0x0000000000400000-0x000000000045A000-memory.dmp
memory/4648-141-0x0000000074DB0000-0x0000000075560000-memory.dmp
memory/4648-142-0x0000000007CF0000-0x0000000008294000-memory.dmp
memory/4648-143-0x00000000077E0000-0x0000000007872000-memory.dmp
memory/4648-144-0x0000000007A30000-0x0000000007A40000-memory.dmp
memory/4648-145-0x0000000007970000-0x000000000797A000-memory.dmp
memory/4648-146-0x00000000088C0000-0x0000000008ED8000-memory.dmp
memory/4648-147-0x0000000007A40000-0x0000000007A52000-memory.dmp
memory/4648-148-0x00000000082A0000-0x00000000083AA000-memory.dmp
memory/4648-149-0x0000000007AA0000-0x0000000007ADC000-memory.dmp
memory/4648-150-0x00000000083B0000-0x0000000008416000-memory.dmp
memory/4648-151-0x00000000092A0000-0x0000000009316000-memory.dmp
memory/4648-152-0x00000000094F0000-0x00000000096B2000-memory.dmp
memory/4648-153-0x0000000009BF0000-0x000000000A11C000-memory.dmp
memory/4648-154-0x00000000093F0000-0x000000000940E000-memory.dmp
memory/4648-155-0x0000000074DB0000-0x0000000075560000-memory.dmp
memory/4648-156-0x0000000009BA0000-0x0000000009BF0000-memory.dmp
memory/4648-157-0x0000000007A30000-0x0000000007A40000-memory.dmp
memory/4648-159-0x0000000074DB0000-0x0000000075560000-memory.dmp