Analysis
-
max time kernel
172s -
max time network
238s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
27-11-2023 05:05
Static task
static1
Behavioral task
behavioral1
Sample
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe
Resource
win10-20231023-en
General
-
Target
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe
-
Size
1.8MB
-
MD5
fac406eb3a620ec45654e087f68ccd9e
-
SHA1
02c21bd71ec411685102670cd4342a332ebaade0
-
SHA256
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
-
SHA512
2668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
SSDEEP
24576:fzzt1HHoz4LbaEz0qd++N2B4cIs1A6HukXhp3HHuTZiF2AVgKOpVftJi:fzzHXLWqp4ejqj3nUiF2A+TpVFJi
Malware Config
Signatures
-
Raccoon Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1944-21-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon behavioral2/memory/1944-23-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1336-25-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exeAddInProcess32.exedescription pid process target process PID 3008 set thread context of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 set thread context of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 1688 set thread context of 1336 1688 AddInProcess32.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exeAddInProcess32.exeInstallUtil.exepid process 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe 1688 AddInProcess32.exe 1688 AddInProcess32.exe 1336 InstallUtil.exe 1336 InstallUtil.exe 1336 InstallUtil.exe 1336 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exeAddInProcess32.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe Token: SeDebugPrivilege 1688 AddInProcess32.exe Token: SeDebugPrivilege 1336 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exeAddInProcess32.exedescription pid process target process PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1688 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 3008 wrote to memory of 1944 3008 de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe AddInProcess32.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe PID 1688 wrote to memory of 1336 1688 AddInProcess32.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe"C:\Users\Admin\AppData\Local\Temp\de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-25-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1336-42-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1336-40-0x0000000009B00000-0x0000000009B1E000-memory.dmpFilesize
120KB
-
memory/1336-39-0x000000000A390000-0x000000000A8BC000-memory.dmpFilesize
5.2MB
-
memory/1336-38-0x0000000009C90000-0x0000000009E52000-memory.dmpFilesize
1.8MB
-
memory/1336-37-0x0000000009A40000-0x0000000009AB6000-memory.dmpFilesize
472KB
-
memory/1336-36-0x0000000008BB0000-0x0000000008C00000-memory.dmpFilesize
320KB
-
memory/1336-35-0x0000000007D90000-0x0000000007DF6000-memory.dmpFilesize
408KB
-
memory/1336-34-0x00000000075A0000-0x00000000075EB000-memory.dmpFilesize
300KB
-
memory/1336-33-0x0000000007560000-0x000000000759E000-memory.dmpFilesize
248KB
-
memory/1336-32-0x0000000007620000-0x000000000772A000-memory.dmpFilesize
1.0MB
-
memory/1336-31-0x00000000074F0000-0x0000000007502000-memory.dmpFilesize
72KB
-
memory/1336-30-0x0000000008240000-0x0000000008846000-memory.dmpFilesize
6.0MB
-
memory/1336-29-0x0000000007260000-0x0000000007270000-memory.dmpFilesize
64KB
-
memory/1336-28-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1688-20-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/1688-15-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1688-17-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/1688-12-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/1688-19-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1688-14-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/1688-27-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1688-16-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/1944-23-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1944-21-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3008-8-0x0000000006880000-0x000000000689A000-memory.dmpFilesize
104KB
-
memory/3008-7-0x0000000005DB0000-0x0000000005DBA000-memory.dmpFilesize
40KB
-
memory/3008-13-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/3008-18-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/3008-11-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/3008-10-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/3008-0-0x0000000000E40000-0x0000000001008000-memory.dmpFilesize
1.8MB
-
memory/3008-24-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/3008-9-0x0000000009F90000-0x0000000009F96000-memory.dmpFilesize
24KB
-
memory/3008-6-0x0000000005DE0000-0x0000000005E72000-memory.dmpFilesize
584KB
-
memory/3008-5-0x0000000005CD0000-0x0000000005D14000-memory.dmpFilesize
272KB
-
memory/3008-4-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/3008-3-0x0000000005E90000-0x000000000638E000-memory.dmpFilesize
5.0MB
-
memory/3008-2-0x00000000056D0000-0x000000000576C000-memory.dmpFilesize
624KB
-
memory/3008-1-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB