Analysis
-
max time kernel
206s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 13:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.166abb67548e0ba1f752a3390a9639b0.exe
-
Size
1.1MB
-
MD5
166abb67548e0ba1f752a3390a9639b0
-
SHA1
55ac375cb138269fb50bb6aa4fb47a1737f3eb3f
-
SHA256
75c176d0f5d671b7a45e3dd6b333eaeab5c62640a2de44966c4731127de75630
-
SHA512
1db79e73c558905039d1497d0ec7ec01c0d3347bfc1aecdb812fa33aea1bc9a1df05da4309c5d778667da351dba7e135f8c8da1ac1ad655d39a72f71feda54f0
-
SSDEEP
12288:gC9Q0g1/Ma29AS087kHCqZ+bwRO7bUjkgkruWSO298PHGc6UuQ+1FQkMPevKK:gtV1L29AX87kHCMVROfuOe+nPev
Malware Config
Extracted
redline
grome
77.91.124.86:19084
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4512-0-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEAS.166abb67548e0ba1f752a3390a9639b0.exedescription pid process target process PID 4144 set thread context of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NEAS.166abb67548e0ba1f752a3390a9639b0.exedescription pid process target process PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe PID 4144 wrote to memory of 4512 4144 NEAS.166abb67548e0ba1f752a3390a9639b0.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.166abb67548e0ba1f752a3390a9639b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.166abb67548e0ba1f752a3390a9639b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4512-0-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4512-1-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4512-2-0x0000000008010000-0x00000000085B4000-memory.dmpFilesize
5.6MB
-
memory/4512-3-0x0000000007A60000-0x0000000007AF2000-memory.dmpFilesize
584KB
-
memory/4512-4-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/4512-5-0x0000000007C60000-0x0000000007C6A000-memory.dmpFilesize
40KB
-
memory/4512-6-0x0000000008BE0000-0x00000000091F8000-memory.dmpFilesize
6.1MB
-
memory/4512-7-0x0000000007E00000-0x0000000007F0A000-memory.dmpFilesize
1.0MB
-
memory/4512-8-0x0000000007D30000-0x0000000007D42000-memory.dmpFilesize
72KB
-
memory/4512-9-0x0000000007D90000-0x0000000007DCC000-memory.dmpFilesize
240KB
-
memory/4512-10-0x0000000007F10000-0x0000000007F5C000-memory.dmpFilesize
304KB
-
memory/4512-11-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4512-12-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB