Analysis
-
max time kernel
138s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
8fa76cd75fe02c1093f254977f44ee79.exe
Resource
win7-20231215-en
General
-
Target
8fa76cd75fe02c1093f254977f44ee79.exe
-
Size
394KB
-
MD5
8fa76cd75fe02c1093f254977f44ee79
-
SHA1
dfa7b0b4d24a93e4463921dbc7886e84dfd60495
-
SHA256
54deea77c66f31b5b2ae101d942ddc0acd04a146f1dadf85f80034e1f6edd567
-
SHA512
37cf4197dd1a2069382c11997c644bea869968beeae55b03b47040372f8dcb1faa75c858916b38e589c6735ef94e912590943ff97691713d6e44760380ac1c74
-
SSDEEP
6144:LNrji59qUe4LHW60V4Ayscy2sF3Y/VAOYc219/BtJTjjn1LFois8ICCKzche/9Wn:L1U9qUe4LZ0N8VwJn1LFoipIMz/QGbi9
Malware Config
Extracted
redline
@soul3ss
188.130.139.12:23747
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-2-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-2-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8fa76cd75fe02c1093f254977f44ee79.exedescription pid process target process PID 208 set thread context of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4492 208 WerFault.exe 8fa76cd75fe02c1093f254977f44ee79.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4596 RegSvcs.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
8fa76cd75fe02c1093f254977f44ee79.exedescription pid process target process PID 208 wrote to memory of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe PID 208 wrote to memory of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe PID 208 wrote to memory of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe PID 208 wrote to memory of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe PID 208 wrote to memory of 4596 208 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa76cd75fe02c1093f254977f44ee79.exe"C:\Users\Admin\AppData\Local\Temp\8fa76cd75fe02c1093f254977f44ee79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 208 -ip 2081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/208-1-0x0000000000A00000-0x0000000000B00000-memory.dmpFilesize
1024KB
-
memory/4596-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4596-7-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4596-8-0x0000000005E90000-0x0000000006434000-memory.dmpFilesize
5.6MB
-
memory/4596-9-0x0000000006A60000-0x0000000007078000-memory.dmpFilesize
6.1MB
-
memory/4596-10-0x0000000005A70000-0x0000000005B02000-memory.dmpFilesize
584KB
-
memory/4596-11-0x0000000005A10000-0x0000000005A22000-memory.dmpFilesize
72KB
-
memory/4596-12-0x0000000005B60000-0x0000000005B9C000-memory.dmpFilesize
240KB
-
memory/4596-13-0x0000000005C20000-0x0000000005C30000-memory.dmpFilesize
64KB
-
memory/4596-14-0x0000000005E00000-0x0000000005E4C000-memory.dmpFilesize
304KB
-
memory/4596-15-0x00000000082E0000-0x00000000083EA000-memory.dmpFilesize
1.0MB
-
memory/4596-16-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4596-17-0x0000000005C20000-0x0000000005C30000-memory.dmpFilesize
64KB