Analysis
-
max time kernel
281s -
max time network
296s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 05:02
Static task
static1
Behavioral task
behavioral1
Sample
4oE045Hr.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4oE045Hr.exe
Resource
win10-20230915-en
General
-
Target
4oE045Hr.exe
-
Size
459KB
-
MD5
0f9bf0eeeae62f42f1e7f735706d1a14
-
SHA1
efd2514c4d6c7e6ce1f39008fafe3bcb8b12408e
-
SHA256
f1626105054686b8af41da05be026b6c8bfb9b9dc052e7c32b79193472f1ceba
-
SHA512
8aafdb85d2a4ca093ab4e0de6601f2a00e04413079b58fb5e0ab710fb3edb1d54796c3b30c6502f626e326c46d322616c7ba195385f4e2ee3158f9dcf361da27
-
SSDEEP
6144:IfThnbDPM4jjdpvIN8fp7z5BAOgfFHN6DEvQiCD8S40X:IfTVDPjjb/+fpNs3dRNX
Malware Config
Extracted
redline
frant
77.91.124.55:19071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2512-6-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2512-4-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2512-8-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2512-10-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2512-12-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4oE045Hr.exedescription pid process target process PID 2984 set thread context of 2512 2984 4oE045Hr.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2664 2984 WerFault.exe 4oE045Hr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
4oE045Hr.exedescription pid process target process PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2512 2984 4oE045Hr.exe AppLaunch.exe PID 2984 wrote to memory of 2664 2984 4oE045Hr.exe WerFault.exe PID 2984 wrote to memory of 2664 2984 4oE045Hr.exe WerFault.exe PID 2984 wrote to memory of 2664 2984 4oE045Hr.exe WerFault.exe PID 2984 wrote to memory of 2664 2984 4oE045Hr.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4oE045Hr.exe"C:\Users\Admin\AppData\Local\Temp\4oE045Hr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1362⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2512-0-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-2-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-6-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2512-4-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-8-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-10-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-12-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2512-13-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2512-14-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2512-15-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB
-
memory/2512-16-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB