Analysis
- max time kernel
149s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
15/11/2023, 17:14
General
- Target NEAS.16a1c64a64c741f354cfa13e4640e2c10917a6968dc0ac075d0c3c13270a87cf.exe
- Size 414KB
- Sample231115-vrydnadb23
- SHA256 16a1c64a64c741f354cfa13e4640e2c10917a6968dc0ac075d0c3c13270a87cf
Malware Config
Extracted
-
redline
-
taiga
-
5.42.92.51:19057
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.16a1c64a64c741f354cfa13e4640e2c10917a6968dc0ac075d0c3c13270a87cf.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.16a1c64a64c741f354cfa13e4640e2c10917a6968dc0ac075d0c3c13270a87cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/336-13-0x00000292CA8A0000-0x00000292CA8B0000-memory.dmp
memory/336-49-0x00000292D2E50000-0x00000292D2E51000-memory.dmp
memory/336-48-0x00000292D2D40000-0x00000292D2D41000-memory.dmp
memory/336-47-0x00000292D2D40000-0x00000292D2D41000-memory.dmp
memory/336-45-0x00000292D2D10000-0x00000292D2D11000-memory.dmp
memory/336-29-0x00000292CA9A0000-0x00000292CA9B0000-memory.dmp
memory/1920-8-0x0000000008120000-0x0000000008132000-memory.dmp
memory/1920-7-0x0000000008250000-0x000000000835A000-memory.dmp
memory/1920-0-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1920-9-0x0000000008180000-0x00000000081BC000-memory.dmp
memory/1920-10-0x00000000081C0000-0x000000000820C000-memory.dmp
memory/1920-11-0x0000000074580000-0x0000000074D30000-memory.dmp
memory/1920-12-0x00000000080C0000-0x00000000080D0000-memory.dmp
memory/1920-6-0x0000000008FC0000-0x00000000095D8000-memory.dmp
memory/1920-5-0x0000000007EB0000-0x0000000007EBA000-memory.dmp
memory/1920-4-0x00000000080C0000-0x00000000080D0000-memory.dmp
memory/1920-3-0x0000000007EE0000-0x0000000007F72000-memory.dmp
memory/1920-2-0x00000000083F0000-0x0000000008994000-memory.dmp
memory/1920-1-0x0000000074580000-0x0000000074D30000-memory.dmp