Analysis
- max time kernel
188s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20230915-en - resource tags
- submitted
21/09/2023, 04:26
General
- Target 50f6cf2beb2bb843bcac1ad02fa62f30ede419d5177b7cf433b99d018d3282b7.exe
- Size 1.0MB
- Sample230921-e2nzzadb3s
- SHA256 50f6cf2beb2bb843bcac1ad02fa62f30ede419d5177b7cf433b99d018d3282b7
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
51.38.95.107:42494
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f6cf2beb2bb843bcac1ad02fa62f30ede419d5177b7cf433b99d018d3282b7.exe"C:\Users\Admin\AppData\Local\Temp\50f6cf2beb2bb843bcac1ad02fa62f30ede419d5177b7cf433b99d018d3282b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 2442⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4268-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4268-4-0x00000000730C0000-0x00000000737AE000-memory.dmp
memory/4268-5-0x0000000009040000-0x0000000009046000-memory.dmp
memory/4268-6-0x000000000EA70000-0x000000000F076000-memory.dmp
memory/4268-7-0x000000000E590000-0x000000000E69A000-memory.dmp
memory/4268-9-0x00000000090D0000-0x00000000090E0000-memory.dmp
memory/4268-8-0x000000000E4C0000-0x000000000E4D2000-memory.dmp
memory/4268-10-0x000000000E520000-0x000000000E55E000-memory.dmp
memory/4268-11-0x000000000E6A0000-0x000000000E6EB000-memory.dmp
memory/4268-16-0x000000000E840000-0x000000000E8B6000-memory.dmp
memory/4268-17-0x000000000E960000-0x000000000E9F2000-memory.dmp
memory/4268-18-0x000000000E8C0000-0x000000000E926000-memory.dmp
memory/4268-19-0x000000000F980000-0x000000000FE7E000-memory.dmp
memory/4268-22-0x000000000F510000-0x000000000F560000-memory.dmp
memory/4268-31-0x000000000FE80000-0x0000000010042000-memory.dmp
memory/4268-32-0x0000000010580000-0x0000000010AAC000-memory.dmp
memory/4268-33-0x00000000730C0000-0x00000000737AE000-memory.dmp
memory/4268-150-0x00000000090D0000-0x00000000090E0000-memory.dmp
memory/4268-403-0x00000000730C0000-0x00000000737AE000-memory.dmp