Analysis
- max time kernel
128s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
29/08/2023, 23:26
General
- Target file.exe
- Size 1.8MB
- Sample230829-3ettpsbf7y
- SHA256 d7090bd33b04f71ac9f01ac7ad9581ea1066a52844b74417d4027ca27475ce72
Malware Config
Extracted
-
redline
-
1006
-
176.123.9.142:14845
-
auth_value
b5da80860b093905c2bba6f9377af704
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2960-6-0x0000000000D40000-0x0000000000F1E000-memory.dmp
memory/2960-0-0x0000000000D40000-0x0000000000F1E000-memory.dmp
memory/3356-12-0x000000000AC70000-0x000000000ACAC000-memory.dmp
memory/3356-15-0x000000000B000000-0x000000000B066000-memory.dmp
memory/3356-8-0x000000000B1C0000-0x000000000B7D8000-memory.dmp
memory/3356-9-0x000000000ACD0000-0x000000000ADDA000-memory.dmp
memory/3356-10-0x0000000005710000-0x0000000005720000-memory.dmp
memory/3356-11-0x000000000AC10000-0x000000000AC22000-memory.dmp
memory/3356-1-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3356-13-0x000000000AF80000-0x000000000AFF6000-memory.dmp
memory/3356-14-0x000000000B0A0000-0x000000000B132000-memory.dmp
memory/3356-7-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/3356-16-0x000000000C190000-0x000000000C734000-memory.dmp
memory/3356-17-0x000000000BF40000-0x000000000C102000-memory.dmp
memory/3356-18-0x000000000CC70000-0x000000000D19C000-memory.dmp
memory/3356-19-0x00000000751D0000-0x0000000075980000-memory.dmp
memory/3356-20-0x000000000BEC0000-0x000000000BF10000-memory.dmp
memory/3356-21-0x0000000005710000-0x0000000005720000-memory.dmp
memory/3356-23-0x00000000751D0000-0x0000000075980000-memory.dmp