Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
16/09/2023, 21:46
General
- Target bd677338df07f7b7534ee9b0a11dc7de.exe
- Size 612KB
- Sample230916-1mlrysge36
- SHA256 0f36e18b4aea416cd5af0d04845ec04d9faab74689fc9257ee5872c858baebb3
Malware Config
Extracted
-
redline
-
smokiez
-
194.169.175.232:45450
-
auth_value
7b7d8a036038ab89b98f422d559b4f8f
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd677338df07f7b7534ee9b0a11dc7de.exe"C:\Users\Admin\AppData\Local\Temp\bd677338df07f7b7534ee9b0a11dc7de.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2044-21-0x000000000AFA0000-0x000000000B032000-memory.dmp
memory/2044-16-0x0000000005560000-0x0000000005570000-memory.dmp
memory/2044-30-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/2044-28-0x000000000A0C0000-0x000000000A110000-memory.dmp
memory/2044-27-0x000000000A2C0000-0x000000000A7EC000-memory.dmp
memory/2044-26-0x0000000009BC0000-0x0000000009D82000-memory.dmp
memory/2044-25-0x0000000005560000-0x0000000005570000-memory.dmp
memory/2044-24-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/2044-23-0x000000000B670000-0x000000000B6D6000-memory.dmp
memory/2044-9-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2044-14-0x000000000B050000-0x000000000B668000-memory.dmp
memory/2044-15-0x000000000ABD0000-0x000000000ACDA000-memory.dmp
memory/2044-12-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/2044-13-0x0000000002ED0000-0x0000000002ED6000-memory.dmp
memory/2044-19-0x000000000ACE0000-0x000000000AD2C000-memory.dmp
memory/2044-20-0x000000000AE80000-0x000000000AEF6000-memory.dmp
memory/2044-22-0x000000000BC20000-0x000000000C1C4000-memory.dmp
memory/2044-17-0x000000000AB10000-0x000000000AB22000-memory.dmp
memory/2044-18-0x000000000AB70000-0x000000000ABAC000-memory.dmp
memory/5060-1-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-11-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-0-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-10-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-8-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-7-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-6-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-5-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-3-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-4-0x0000000000400000-0x0000000000465000-memory.dmp
memory/5060-2-0x0000000000400000-0x0000000000465000-memory.dmp