Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 11:20
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
General
-
Target
tmp.exe
-
Size
990KB
-
MD5
9056dca80b3431615d63b13b72ca143c
-
SHA1
cf9122b3b7f57f0f4cd6ff8303417f1f6279a80c
-
SHA256
cedfb47b22871e12b67b3d7d01e4eb1bcad63bf61dfab89db5acde64cc12832b
-
SHA512
13a26a8d261ff4c6d83158ea0d7d99aac670159fca9f2a6b1e180ed9be1bdd5abdceab2fc232774f828c61d3aa267f29cebc22fe3d276fd0ae8d7e4681f38fb2
-
SSDEEP
12288:dRMAkWbP+k/ldbNxhZcKMMbm8gtnwaJioTTQ3AwHuwZ+U4cxV0q4Z5g1:HMAkCP+k/l7xhZcKMwmSajn/U4cO2
Malware Config
Extracted
redline
900751123
https://pastebin.com/raw/KE5Mft0T
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-0-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/3992-1-0x0000000000310000-0x000000000040D000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 3992 set thread context of 2372 3992 tmp.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5016 3992 WerFault.exe tmp.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
RegAsm.exepid process 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe 2372 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2372 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exedescription pid process target process PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe PID 3992 wrote to memory of 2372 3992 tmp.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 3322⤵
- Program crash
PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 39921⤵PID:972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2372-10-0x0000000006730000-0x00000000068F2000-memory.dmpFilesize
1.8MB
-
memory/2372-17-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB
-
memory/2372-2-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB
-
memory/2372-3-0x0000000004EC0000-0x0000000004F26000-memory.dmpFilesize
408KB
-
memory/2372-4-0x0000000005A10000-0x0000000006028000-memory.dmpFilesize
6.1MB
-
memory/2372-5-0x0000000005480000-0x0000000005492000-memory.dmpFilesize
72KB
-
memory/2372-6-0x00000000055B0000-0x00000000056BA000-memory.dmpFilesize
1.0MB
-
memory/2372-0-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2372-20-0x0000000074310000-0x0000000074AC0000-memory.dmpFilesize
7.7MB
-
memory/2372-8-0x00000000063B0000-0x00000000063EC000-memory.dmpFilesize
240KB
-
memory/2372-7-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/2372-11-0x0000000006E30000-0x000000000735C000-memory.dmpFilesize
5.2MB
-
memory/2372-12-0x0000000007910000-0x0000000007EB4000-memory.dmpFilesize
5.6MB
-
memory/2372-13-0x0000000006AA0000-0x0000000006B32000-memory.dmpFilesize
584KB
-
memory/2372-14-0x0000000006900000-0x0000000006950000-memory.dmpFilesize
320KB
-
memory/2372-15-0x00000000069D0000-0x0000000006A46000-memory.dmpFilesize
472KB
-
memory/2372-16-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/2372-9-0x00000000063F0000-0x000000000643C000-memory.dmpFilesize
304KB
-
memory/2372-18-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3992-1-0x0000000000310000-0x000000000040D000-memory.dmpFilesize
1012KB