Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2023 11:56
Static task
static1
Behavioral task
behavioral1
Sample
b192f51a9a9b24335343f938ec013807.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b192f51a9a9b24335343f938ec013807.exe
Resource
win10v2004-20230703-en
General
-
Target
b192f51a9a9b24335343f938ec013807.exe
-
Size
3.1MB
-
MD5
b192f51a9a9b24335343f938ec013807
-
SHA1
fc9bf988de04d3aaca9ad58a560ce692bd3b3f19
-
SHA256
7ae0605aec439455add9082308a769a1cb0b48d8d1ee8f94bd1710a41d268adb
-
SHA512
671af2f3026acf3659790424a3585fd269375e715d9cc216a2ab614dc02ccd69fe81eb68fda879a1ad98a7cc953c84de6a0774170a59b40237ace85210303c32
-
SSDEEP
49152:nb1M1G3PTXchznEJuuGHefKs2F9Oi3Tqs5nZBjdjo+BVQ2X:nbAQGd3TLTqs5Z7s+BVQ2X
Malware Config
Extracted
redline
777
5.75.163.194:25084
-
auth_value
001b77c5bf14ffc62c97804130865cf9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exedescription pid process target process PID 4812 set thread context of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
jsc.exepid process 5076 jsc.exe 5076 jsc.exe 5076 jsc.exe 5076 jsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exejsc.exedescription pid process Token: SeDebugPrivilege 4812 b192f51a9a9b24335343f938ec013807.exe Token: SeDebugPrivilege 5076 jsc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exedescription pid process target process PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 4812 wrote to memory of 5076 4812 b192f51a9a9b24335343f938ec013807.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b192f51a9a9b24335343f938ec013807.exe"C:\Users\Admin\AppData\Local\Temp\b192f51a9a9b24335343f938ec013807.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4812-161-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-147-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-135-0x0000000005A10000-0x0000000005A20000-memory.dmpFilesize
64KB
-
memory/4812-136-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4812-137-0x00000000057A0000-0x000000000583C000-memory.dmpFilesize
624KB
-
memory/4812-138-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/4812-139-0x0000000005A10000-0x0000000005A20000-memory.dmpFilesize
64KB
-
memory/4812-141-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-140-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-143-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-145-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-168-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/4812-149-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-164-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/4812-153-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-155-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-157-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-159-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-133-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/4812-134-0x0000000000AB0000-0x0000000000DC8000-memory.dmpFilesize
3.1MB
-
memory/4812-151-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/4812-163-0x00000000058D0000-0x00000000058E5000-memory.dmpFilesize
84KB
-
memory/5076-178-0x000000000E5D0000-0x000000000E792000-memory.dmpFilesize
1.8MB
-
memory/5076-167-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/5076-169-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/5076-170-0x000000000AE70000-0x000000000B488000-memory.dmpFilesize
6.1MB
-
memory/5076-171-0x000000000C800000-0x000000000C90A000-memory.dmpFilesize
1.0MB
-
memory/5076-172-0x000000000C9C0000-0x000000000C9D2000-memory.dmpFilesize
72KB
-
memory/5076-173-0x000000000CA20000-0x000000000CA5C000-memory.dmpFilesize
240KB
-
memory/5076-174-0x000000000D6E0000-0x000000000D756000-memory.dmpFilesize
472KB
-
memory/5076-175-0x000000000D800000-0x000000000D892000-memory.dmpFilesize
584KB
-
memory/5076-176-0x000000000DE50000-0x000000000E3F4000-memory.dmpFilesize
5.6MB
-
memory/5076-177-0x000000000D8A0000-0x000000000D906000-memory.dmpFilesize
408KB
-
memory/5076-165-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/5076-179-0x000000000ECD0000-0x000000000F1FC000-memory.dmpFilesize
5.2MB
-
memory/5076-180-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB
-
memory/5076-181-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/5076-182-0x000000000DD60000-0x000000000DDB0000-memory.dmpFilesize
320KB
-
memory/5076-184-0x0000000075290000-0x0000000075A40000-memory.dmpFilesize
7.7MB