Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
16/11/2023, 03:06
General
- Target 0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe
- Size 414KB
- Sample231116-dlrkgsfc72
- SHA256 0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10
Malware Config
Extracted
-
redline
-
taiga
-
5.42.92.51:19057
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe"C:\Users\Admin\AppData\Local\Temp\0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/2752-6-0x00000000087C0000-0x0000000008DD8000-memory.dmp
memory/2752-2-0x0000000007BF0000-0x0000000008194000-memory.dmp
memory/2752-3-0x0000000007720000-0x00000000077B2000-memory.dmp
memory/2752-4-0x00000000076B0000-0x00000000076C0000-memory.dmp
memory/2752-5-0x0000000007900000-0x000000000790A000-memory.dmp
memory/2752-0-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2752-7-0x0000000007AB0000-0x0000000007BBA000-memory.dmp
memory/2752-8-0x00000000079E0000-0x00000000079F2000-memory.dmp
memory/2752-9-0x0000000007A40000-0x0000000007A7C000-memory.dmp
memory/2752-10-0x00000000081A0000-0x00000000081EC000-memory.dmp
memory/2752-11-0x00000000749B0000-0x0000000075160000-memory.dmp
memory/2752-12-0x00000000076B0000-0x00000000076C0000-memory.dmp
memory/2752-1-0x00000000749B0000-0x0000000075160000-memory.dmp
memory/4768-48-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-55-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-46-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-47-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-29-0x0000022D35440000-0x0000022D35450000-memory.dmp
memory/4768-49-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-50-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-51-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-52-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-53-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-54-0x0000022D3DA60000-0x0000022D3DA61000-memory.dmp
memory/4768-45-0x0000022D3DA30000-0x0000022D3DA31000-memory.dmp
memory/4768-56-0x0000022D3D680000-0x0000022D3D681000-memory.dmp
memory/4768-57-0x0000022D3D670000-0x0000022D3D671000-memory.dmp
memory/4768-59-0x0000022D3D680000-0x0000022D3D681000-memory.dmp
memory/4768-62-0x0000022D3D670000-0x0000022D3D671000-memory.dmp
memory/4768-65-0x0000022D3D5B0000-0x0000022D3D5B1000-memory.dmp
memory/4768-13-0x0000022D35340000-0x0000022D35350000-memory.dmp
memory/4768-77-0x0000022D3D7B0000-0x0000022D3D7B1000-memory.dmp
memory/4768-79-0x0000022D3D7C0000-0x0000022D3D7C1000-memory.dmp
memory/4768-80-0x0000022D3D7C0000-0x0000022D3D7C1000-memory.dmp
memory/4768-81-0x0000022D3D8D0000-0x0000022D3D8D1000-memory.dmp