Analysis
- max time kernel
118s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
25/09/2023, 07:42
General
- Target file.exe
- Size 412KB
- Sample230925-jjnnpsdd3t
- SHA256 b7bae8c3d2721f387a3e6316f8fb83bcc08e4b46767f86fa46d018b6cfc6f161
Malware Config
Extracted
-
redline
-
194.169.175.232:45451
-
auth_value
277a7742ea9b1da2a636fb11c1abcacd
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 2202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4952 -ip 49521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1524-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1524-1-0x00000000746A0000-0x0000000074E50000-memory.dmp
memory/1524-2-0x0000000002D00000-0x0000000002D06000-memory.dmp
memory/1524-3-0x0000000005A40000-0x0000000006058000-memory.dmp
memory/1524-4-0x0000000005530000-0x000000000563A000-memory.dmp
memory/1524-5-0x0000000002E60000-0x0000000002E70000-memory.dmp
memory/1524-6-0x0000000002E10000-0x0000000002E22000-memory.dmp
memory/1524-7-0x0000000005420000-0x000000000545C000-memory.dmp
memory/1524-8-0x0000000002E80000-0x0000000002ECC000-memory.dmp
memory/1524-9-0x00000000056E0000-0x0000000005756000-memory.dmp
memory/1524-10-0x0000000005800000-0x0000000005892000-memory.dmp
memory/1524-11-0x0000000006B00000-0x00000000070A4000-memory.dmp
memory/1524-12-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/1524-13-0x0000000006720000-0x00000000068E2000-memory.dmp
memory/1524-14-0x0000000008CD0000-0x00000000091FC000-memory.dmp
memory/1524-15-0x00000000746A0000-0x0000000074E50000-memory.dmp
memory/1524-16-0x0000000008010000-0x0000000008060000-memory.dmp
memory/1524-17-0x0000000002E60000-0x0000000002E70000-memory.dmp
memory/1524-19-0x00000000746A0000-0x0000000074E50000-memory.dmp