Analysis
- max time kernel
108s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
18/09/2023, 15:31
General
- Target file.exe
- Size 405KB
- Sample230918-sx11macf27
- SHA256 ea63340c1c1914c476b780cf79e8189c9aa1b38ff6b406f66a3fc630799cb911
Malware Config
Extracted
-
redline
-
smokiez
-
194.169.175.232:45450
-
auth_value
7b7d8a036038ab89b98f422d559b4f8f
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3668-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3668-1-0x0000000075070000-0x0000000075820000-memory.dmp
memory/3668-2-0x0000000002D40000-0x0000000002D46000-memory.dmp
memory/3668-3-0x0000000005B90000-0x00000000061A8000-memory.dmp
memory/3668-4-0x0000000005680000-0x000000000578A000-memory.dmp
memory/3668-5-0x0000000005460000-0x0000000005470000-memory.dmp
memory/3668-6-0x0000000005420000-0x0000000005432000-memory.dmp
memory/3668-7-0x00000000055B0000-0x00000000055EC000-memory.dmp
memory/3668-8-0x00000000055F0000-0x000000000563C000-memory.dmp
memory/3668-9-0x0000000075070000-0x0000000075820000-memory.dmp
memory/3668-10-0x00000000058A0000-0x0000000005916000-memory.dmp
memory/3668-11-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/3668-12-0x0000000006C50000-0x00000000071F4000-memory.dmp
memory/3668-13-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/3668-14-0x00000000069A0000-0x0000000006B62000-memory.dmp
memory/3668-15-0x0000000008E20000-0x000000000934C000-memory.dmp
memory/3668-16-0x0000000005460000-0x0000000005470000-memory.dmp
memory/3668-17-0x0000000006BE0000-0x0000000006C30000-memory.dmp
memory/3668-19-0x0000000075070000-0x0000000075820000-memory.dmp