Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 13:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
-
Size
1.1MB
-
MD5
166abb67548e0ba1f752a3390a9639b0
-
SHA1
55ac375cb138269fb50bb6aa4fb47a1737f3eb3f
-
SHA256
75c176d0f5d671b7a45e3dd6b333eaeab5c62640a2de44966c4731127de75630
-
SHA512
1db79e73c558905039d1497d0ec7ec01c0d3347bfc1aecdb812fa33aea1bc9a1df05da4309c5d778667da351dba7e135f8c8da1ac1ad655d39a72f71feda54f0
-
SSDEEP
12288:gC9Q0g1/Ma29AS087kHCqZ+bwRO7bUjkgkruWSO298PHGc6UuQ+1FQkMPevKK:gtV1L29AX87kHCMVROfuOe+nPev
Malware Config
Extracted
redline
grome
77.91.124.86:19084
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-2-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2032-3-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2032-5-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2032-7-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2032-9-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/2032-13-0x0000000007190000-0x00000000071D0000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEAS.166abb67548e0ba1f752a3390a9639b0.exedescription pid process target process PID 2068 set thread context of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.166abb67548e0ba1f752a3390a9639b0.exedescription pid process target process PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 2068 wrote to memory of 2032 2068 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.166abb67548e0ba1f752a3390a9639b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.166abb67548e0ba1f752a3390a9639b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-0-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-1-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-2-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-3-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2032-5-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-7-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-9-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-10-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2032-11-0x0000000007190000-0x00000000071D0000-memory.dmpFilesize
256KB
-
memory/2032-12-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2032-13-0x0000000007190000-0x00000000071D0000-memory.dmpFilesize
256KB