Analysis
- max time kernel
140s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
12/10/2023, 12:20
General
- Target 443a2a80342e250493c764a1a2507766.exe
- Size 397KB
- Sample231012-phxg4sca29
- SHA256 36409da21c9c35416d4bf8c12e76042a7bcb09b8ab659545a33bd1d078e0dd86
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
51.38.95.107:42494
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\443a2a80342e250493c764a1a2507766.exe"C:\Users\Admin\AppData\Local\Temp\443a2a80342e250493c764a1a2507766.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 3042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4040 -ip 40401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1344-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1344-1-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/1344-2-0x0000000000F20000-0x0000000000F26000-memory.dmp
memory/1344-3-0x0000000005500000-0x0000000005B18000-memory.dmp
memory/1344-4-0x0000000004FF0000-0x00000000050FA000-memory.dmp
memory/1344-5-0x0000000004F20000-0x0000000004F32000-memory.dmp
memory/1344-6-0x0000000002870000-0x0000000002880000-memory.dmp
memory/1344-7-0x0000000004F80000-0x0000000004FBC000-memory.dmp
memory/1344-8-0x0000000005100000-0x000000000514C000-memory.dmp
memory/1344-9-0x00000000745C0000-0x0000000074D70000-memory.dmp
memory/1344-10-0x0000000002870000-0x0000000002880000-memory.dmp