Analysis
-
max time kernel
292s -
max time network
299s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
19-09-2023 06:53
Static task
static1
Behavioral task
behavioral1
Sample
j5220189.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
j5220189.exe
Resource
win10-20230915-en
General
-
Target
j5220189.exe
-
Size
399KB
-
MD5
6911db4059e254077f03d58ef899a334
-
SHA1
dd476b4e26a3e102998886a5c111fe4a493a9a21
-
SHA256
f18ee2360eb587bdf735ce3886c728f54cace99210a6528adf5846e911a3e01b
-
SHA512
e5f6f56205672df854a0e942f51f070f1bc395c3d547d3f271ac28807cf390b5b71c6cc783771ae25648cb7fea0dfb2275264ee23ad6fe59ab17ff0690427f37
-
SSDEEP
6144:+jpjE12jicP5iOo2T8VrSd/sUAO8clkwUv5M3pQ1xeKM7ZzuF9iHpFGazEU1Sa:+jpcqiG59ouecGteKMFo9SN51Sa
Malware Config
Extracted
redline
monik
77.91.124.82:19071
-
auth_value
da7d9ea0878f5901f1f8319d34bdccea
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
j5220189.exedescription pid process target process PID 1700 set thread context of 2132 1700 j5220189.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
j5220189.exedescription pid process target process PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe PID 1700 wrote to memory of 2132 1700 j5220189.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\j5220189.exe"C:\Users\Admin\AppData\Local\Temp\j5220189.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-1-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-0-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-2-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-3-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2132-5-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-9-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-7-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-10-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2132-11-0x00000000005D0000-0x00000000005D6000-memory.dmpFilesize
24KB
-
memory/2132-12-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB
-
memory/2132-13-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2132-14-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB