Analysis
- max time kernel
290s - max time network
298s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
29/04/2024, 04:28
General
- Target da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d.exe
- Size 392KB
- Sample240429-e3ywkaaf2s
- SHA256 da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
5.42.65.0:29587
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d.exe"C:\Users\Admin\AppData\Local\Temp\da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 8122⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/420-0-0x0000000000510000-0x0000000000574000-memory.dmp
memory/420-1-0x0000000073C00000-0x00000000742EE000-memory.dmp
memory/420-2-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
memory/420-3-0x0000000002980000-0x0000000002981000-memory.dmp
memory/420-20-0x00000000029E0000-0x00000000049E0000-memory.dmp
memory/420-19-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
memory/420-18-0x0000000073C00000-0x00000000742EE000-memory.dmp
memory/420-10-0x00000000029E0000-0x00000000049E0000-memory.dmp
memory/3068-11-0x0000000073C00000-0x00000000742EE000-memory.dmp
memory/3068-12-0x0000000005450000-0x000000000545A000-memory.dmp
memory/3068-13-0x0000000006400000-0x0000000006A06000-memory.dmp
memory/3068-14-0x0000000005DF0000-0x0000000005EFA000-memory.dmp
memory/3068-15-0x00000000055F0000-0x0000000005602000-memory.dmp
memory/3068-16-0x0000000005610000-0x000000000564E000-memory.dmp
memory/3068-17-0x0000000005650000-0x000000000569B000-memory.dmp
memory/3068-9-0x0000000005490000-0x0000000005522000-memory.dmp
memory/3068-8-0x00000000058F0000-0x0000000005DEE000-memory.dmp
memory/3068-6-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3068-21-0x0000000073C00000-0x00000000742EE000-memory.dmp