Analysis
- max time kernel
142s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230831-en - resource tags
- submitted
10/09/2023, 19:42
General
- Target file.exe
- Size 1.4MB
- Sample230910-yem9psbc4v
- SHA256 a52b1bac7fc89df6491f6528ef4ed0f23b35d7e55b5c133ae6488f3efa80fba5
Malware Config
Extracted
-
redline
-
1006
-
176.123.9.142:14845
-
auth_value
b5da80860b093905c2bba6f9377af704
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1296-6-0x0000000000260000-0x00000000003D1000-memory.dmp
memory/1296-0-0x0000000000260000-0x00000000003D1000-memory.dmp
memory/4628-12-0x000000000A3E0000-0x000000000A41C000-memory.dmp
memory/4628-15-0x000000000A770000-0x000000000A7D6000-memory.dmp
memory/4628-8-0x000000000A9A0000-0x000000000AFB8000-memory.dmp
memory/4628-9-0x000000000A490000-0x000000000A59A000-memory.dmp
memory/4628-11-0x0000000001000000-0x0000000001010000-memory.dmp
memory/4628-10-0x000000000A380000-0x000000000A392000-memory.dmp
memory/4628-1-0x00000000003D0000-0x0000000000400000-memory.dmp
memory/4628-13-0x000000000A6F0000-0x000000000A766000-memory.dmp
memory/4628-14-0x000000000A810000-0x000000000A8A2000-memory.dmp
memory/4628-7-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/4628-16-0x000000000B970000-0x000000000BF14000-memory.dmp
memory/4628-17-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/4628-18-0x000000000B790000-0x000000000B952000-memory.dmp
memory/4628-19-0x000000000C450000-0x000000000C97C000-memory.dmp
memory/4628-20-0x0000000001000000-0x0000000001010000-memory.dmp
memory/4628-21-0x000000000B640000-0x000000000B690000-memory.dmp
memory/4628-23-0x0000000074D80000-0x0000000075530000-memory.dmp