Analysis
- max time kernel
290s - max time network
292s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
30/05/2024, 23:41
General
- Target fb5312e418e0590527d601bf5099e185bd3d5dc31bb8dd9f72dead207f7a7008.exe
- Size 4.4MB
- Sample240530-3ppbzaef31
- SHA256 fb5312e418e0590527d601bf5099e185bd3d5dc31bb8dd9f72dead207f7a7008
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
5.42.65.129:2353
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb5312e418e0590527d601bf5099e185bd3d5dc31bb8dd9f72dead207f7a7008.exe"C:\Users\Admin\AppData\Local\Temp\fb5312e418e0590527d601bf5099e185bd3d5dc31bb8dd9f72dead207f7a7008.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2496-75-0x0000000004E90000-0x0000000004E9A000-memory.dmp
memory/2496-86-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/2496-84-0x0000000007140000-0x000000000766C000-memory.dmp
memory/2496-83-0x0000000006A40000-0x0000000006C02000-memory.dmp
memory/2496-82-0x0000000006720000-0x0000000006770000-memory.dmp
memory/2496-81-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/2496-80-0x0000000005100000-0x000000000514B000-memory.dmp
memory/2496-79-0x0000000005170000-0x00000000051AE000-memory.dmp
memory/2496-78-0x00000000050D0000-0x00000000050E2000-memory.dmp
memory/2496-67-0x0000000000400000-0x0000000000450000-memory.dmp
memory/2496-77-0x0000000005860000-0x000000000596A000-memory.dmp
memory/2496-76-0x0000000005E70000-0x0000000006476000-memory.dmp
memory/2496-70-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/2496-74-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/2496-71-0x0000000005360000-0x000000000585E000-memory.dmp
memory/2496-73-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/3692-49-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-34-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-62-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-72-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/3692-59-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-68-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/3692-57-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-54-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-52-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-64-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-50-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-0-0x00000000730EE000-0x00000000730EF000-memory.dmp
memory/3692-46-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-66-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-44-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-42-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-40-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-38-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-36-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-60-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-32-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-30-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-8-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-28-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-6-0x0000000005090000-0x00000000050AC000-memory.dmp
memory/3692-26-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-25-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-22-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-21-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-19-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-16-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-14-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-12-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-10-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-7-0x0000000005090000-0x00000000050A5000-memory.dmp
memory/3692-5-0x00000000055D0000-0x00000000057B6000-memory.dmp
memory/3692-4-0x0000000005250000-0x00000000054D2000-memory.dmp
memory/3692-3-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/3692-2-0x0000000005150000-0x00000000051EC000-memory.dmp
memory/3692-1-0x0000000000410000-0x0000000000880000-memory.dmp