Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
12-08-2023 11:57
Static task
static1
Behavioral task
behavioral1
Sample
b192f51a9a9b24335343f938ec013807.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b192f51a9a9b24335343f938ec013807.exe
Resource
win10v2004-20230703-en
General
-
Target
b192f51a9a9b24335343f938ec013807.exe
-
Size
3.1MB
-
MD5
b192f51a9a9b24335343f938ec013807
-
SHA1
fc9bf988de04d3aaca9ad58a560ce692bd3b3f19
-
SHA256
7ae0605aec439455add9082308a769a1cb0b48d8d1ee8f94bd1710a41d268adb
-
SHA512
671af2f3026acf3659790424a3585fd269375e715d9cc216a2ab614dc02ccd69fe81eb68fda879a1ad98a7cc953c84de6a0774170a59b40237ace85210303c32
-
SSDEEP
49152:nb1M1G3PTXchznEJuuGHefKs2F9Oi3Tqs5nZBjdjo+BVQ2X:nbAQGd3TLTqs5Z7s+BVQ2X
Malware Config
Extracted
redline
777
5.75.163.194:25084
-
auth_value
001b77c5bf14ffc62c97804130865cf9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exedescription pid process target process PID 2564 set thread context of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
jsc.exepid process 2936 jsc.exe 2936 jsc.exe 2936 jsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exejsc.exedescription pid process Token: SeDebugPrivilege 2564 b192f51a9a9b24335343f938ec013807.exe Token: SeDebugPrivilege 2936 jsc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b192f51a9a9b24335343f938ec013807.exedescription pid process target process PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe PID 2564 wrote to memory of 2936 2564 b192f51a9a9b24335343f938ec013807.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b192f51a9a9b24335343f938ec013807.exe"C:\Users\Admin\AppData\Local\Temp\b192f51a9a9b24335343f938ec013807.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2564-79-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-69-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-56-0x0000000005020000-0x0000000005060000-memory.dmpFilesize
256KB
-
memory/2564-54-0x00000000002E0000-0x00000000005F8000-memory.dmpFilesize
3.1MB
-
memory/2564-58-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB
-
memory/2564-59-0x0000000005020000-0x0000000005060000-memory.dmpFilesize
256KB
-
memory/2564-60-0x0000000000600000-0x000000000064C000-memory.dmpFilesize
304KB
-
memory/2564-61-0x0000000000650000-0x000000000066C000-memory.dmpFilesize
112KB
-
memory/2564-62-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-63-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-65-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-102-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB
-
memory/2564-67-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-73-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-71-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-77-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-75-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-81-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-57-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2564-55-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB
-
memory/2564-86-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/2564-83-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2564-85-0x0000000000650000-0x0000000000665000-memory.dmpFilesize
84KB
-
memory/2936-107-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2936-89-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-93-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-95-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2936-97-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-99-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-101-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-91-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-104-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/2936-103-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB
-
memory/2936-105-0x0000000004850000-0x0000000004890000-memory.dmpFilesize
256KB
-
memory/2936-106-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB
-
memory/2936-87-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2936-108-0x0000000074310000-0x00000000749FE000-memory.dmpFilesize
6.9MB