Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/06/2024, 01:43
General
- Target f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe
- Size 2.5MB
- Sample240609-b5ghhscd55
- SHA256 f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
5.42.65.63:14707
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe"C:\Users\Admin\AppData\Local\Temp\f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4136-40-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-58-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-2-0x00000000051F0000-0x000000000528C000-memory.dmp
memory/4136-3-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/4136-4-0x0000000005330000-0x0000000005430000-memory.dmp
memory/4136-5-0x0000000005430000-0x0000000005516000-memory.dmp
memory/4136-6-0x00000000051B0000-0x00000000051CC000-memory.dmp
memory/4136-10-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-32-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-66-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-38-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-64-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-69-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/4136-62-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-44-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-42-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-73-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/4136-7-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-60-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-12-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-56-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-54-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-50-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-48-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-46-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-8-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-1-0x0000000000560000-0x00000000007F0000-memory.dmp
memory/4136-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp
memory/4136-52-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-36-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-35-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-30-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-29-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-27-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-24-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-23-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-20-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-18-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-16-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4136-14-0x00000000051B0000-0x00000000051C5000-memory.dmp
memory/4340-72-0x0000000005400000-0x0000000005492000-memory.dmp
memory/4340-78-0x0000000005660000-0x0000000005672000-memory.dmp
memory/4340-75-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/4340-74-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/4340-70-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/4340-71-0x00000000059B0000-0x0000000005F54000-memory.dmp
memory/4340-76-0x0000000006580000-0x0000000006B98000-memory.dmp
memory/4340-77-0x0000000005730000-0x000000000583A000-memory.dmp
memory/4340-67-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4340-79-0x00000000056C0000-0x00000000056FC000-memory.dmp
memory/4340-80-0x0000000005840000-0x000000000588C000-memory.dmp
memory/4340-81-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/4340-82-0x0000000007070000-0x0000000007232000-memory.dmp
memory/4340-83-0x0000000007770000-0x0000000007C9C000-memory.dmp
memory/4340-84-0x0000000007000000-0x0000000007050000-memory.dmp
memory/4340-86-0x0000000074BF0000-0x00000000753A0000-memory.dmp