Analysis
-
max time kernel
451s -
max time network
455s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2024 00:56
Behavioral task
behavioral1
Sample
2 files.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
YT.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
lolMiner.exe
Resource
win10v2004-20231215-en
General
-
Target
YT.exe
-
Size
2.2MB
-
MD5
b1087aa5a1a538d7ee3bd9c3b774bb38
-
SHA1
0842a7d8905be9dbe06f9b2bd7376f33373af246
-
SHA256
c85533dc3627cc14b81a22fb204c42c9e5527e15ad78c832da7a159825de6ec7
-
SHA512
46aec87f752382ec9a5ce6f45af70ab54ae3fe158cd2084b27ca55d8224c83417c8a13091648b4b1ffdbf76f2b88ffa0424a76d3619c3516645e70b0c6969cb6
-
SSDEEP
24576:EQ1OwhF5/u7S/OiUVkcOpckjLDSvWrtaG2cskcA8AvuyLdk0JdQGwct28MENdhX2:DMwP5/u79ScOqkjqOrnq29QFxa
Malware Config
Extracted
redline
Legaa
185.172.128.33:38294
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3048-4-0x0000000000510000-0x0000000000562000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
YT.exedescription pid process target process PID 4940 set thread context of 3048 4940 YT.exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jsc.exepid process 3048 jsc.exe 3048 jsc.exe 3048 jsc.exe 3048 jsc.exe 3048 jsc.exe 3048 jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
jsc.exedescription pid process Token: SeDebugPrivilege 3048 jsc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
YT.exedescription pid process target process PID 4940 wrote to memory of 3048 4940 YT.exe jsc.exe PID 4940 wrote to memory of 3048 4940 YT.exe jsc.exe PID 4940 wrote to memory of 3048 4940 YT.exe jsc.exe PID 4940 wrote to memory of 3048 4940 YT.exe jsc.exe PID 4940 wrote to memory of 3048 4940 YT.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\YT.exe"C:\Users\Admin\AppData\Local\Temp\YT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-14-0x0000000004ED0000-0x0000000004F0C000-memory.dmpFilesize
240KB
-
memory/3048-23-0x0000000075170000-0x0000000075920000-memory.dmpFilesize
7.7MB
-
memory/3048-4-0x0000000000510000-0x0000000000562000-memory.dmpFilesize
328KB
-
memory/3048-7-0x00000000052C0000-0x0000000005864000-memory.dmpFilesize
5.6MB
-
memory/3048-8-0x0000000004C00000-0x0000000004C92000-memory.dmpFilesize
584KB
-
memory/3048-9-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/3048-10-0x0000000004BB0000-0x0000000004BBA000-memory.dmpFilesize
40KB
-
memory/3048-13-0x0000000004E30000-0x0000000004E42000-memory.dmpFilesize
72KB
-
memory/3048-6-0x0000000075170000-0x0000000075920000-memory.dmpFilesize
7.7MB
-
memory/3048-15-0x0000000004F10000-0x0000000004F5C000-memory.dmpFilesize
304KB
-
memory/3048-11-0x0000000005E90000-0x00000000064A8000-memory.dmpFilesize
6.1MB
-
memory/3048-12-0x0000000004FA0000-0x00000000050AA000-memory.dmpFilesize
1.0MB
-
memory/3048-16-0x00000000051A0000-0x0000000005206000-memory.dmpFilesize
408KB
-
memory/3048-17-0x0000000006880000-0x0000000006A42000-memory.dmpFilesize
1.8MB
-
memory/3048-18-0x0000000006F80000-0x00000000074AC000-memory.dmpFilesize
5.2MB
-
memory/3048-19-0x0000000006780000-0x00000000067D0000-memory.dmpFilesize
320KB
-
memory/3048-20-0x0000000075170000-0x0000000075920000-memory.dmpFilesize
7.7MB
-
memory/3048-21-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4940-5-0x00007FF76D3A0000-0x00007FF76D635000-memory.dmpFilesize
2.6MB