Analysis

  • max time kernel
    84s
  • max time network
    101s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    07-07-2024 13:01

General

  • Target

    StartGame.exe

  • Size

    607KB

  • MD5

    29510728a0686202ce3ff9cb067afa3d

  • SHA1

    e7fe35d4160227c9d4321cb98784a073e00e49a7

  • SHA256

    8ef64f8c3492f5f00b8b0a26aff7423b5d5b06822e971990f064bdba4704b13f

  • SHA512

    ad97167c1c7e94f5c158a4c605790f792d44d1d9a30df588f2d16ada1102601ba627b1dd9f34d1073c8ce5548bb729645f8cbbe375f5d7968955dc84391e7b07

  • SSDEEP

    12288:m7CYA39RdCtUYORF3xhU/dOXWW0GH57TQS03ULaHNqrxlKIQNodEqolY3NVzrEeD:bthS1OXW3GZ7TkEaHNYK3O7oy3NVzLwc

Score
10/10

Malware Config

Extracted

Family

redline

C2

95.217.197.197:11343

Attributes
  • auth_value

    c2cfe5d9c6a68540de964b2bf59551e1

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartGame.exe
    "C:\Users\Admin\AppData\Local\Temp\StartGame.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:2728
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2796
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x50c
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2548

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1996-13-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-19-0x00000000031F0000-0x00000000031F3000-memory.dmp

        Filesize

        12KB

      • memory/1996-17-0x00000000031F0000-0x00000000031F1000-memory.dmp

        Filesize

        4KB

      • memory/1996-12-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-20-0x0000000003240000-0x0000000003241000-memory.dmp

        Filesize

        4KB

      • memory/1996-11-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-26-0x0000000003220000-0x0000000003221000-memory.dmp

        Filesize

        4KB

      • memory/1996-25-0x0000000003230000-0x0000000003231000-memory.dmp

        Filesize

        4KB

      • memory/1996-24-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

      • memory/1996-23-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

      • memory/1996-22-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-21-0x0000000003240000-0x0000000003241000-memory.dmp

        Filesize

        4KB

      • memory/1996-18-0x00000000031F0000-0x00000000032F0000-memory.dmp

        Filesize

        1024KB

      • memory/1996-16-0x00000000031F0000-0x00000000031F1000-memory.dmp

        Filesize

        4KB

      • memory/1996-15-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-14-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-0-0x0000000000400000-0x0000000000573000-memory.dmp

        Filesize

        1.4MB

      • memory/1996-1-0x00000000005F0000-0x0000000000650000-memory.dmp

        Filesize

        384KB

      • memory/1996-27-0x0000000003210000-0x0000000003211000-memory.dmp

        Filesize

        4KB

      • memory/1996-10-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-9-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-8-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1996-7-0x0000000002350000-0x0000000002351000-memory.dmp

        Filesize

        4KB

      • memory/1996-6-0x0000000000710000-0x0000000000711000-memory.dmp

        Filesize

        4KB

      • memory/1996-5-0x0000000000680000-0x0000000000681000-memory.dmp

        Filesize

        4KB

      • memory/1996-4-0x0000000000660000-0x0000000000661000-memory.dmp

        Filesize

        4KB

      • memory/1996-3-0x00000000006F0000-0x00000000006F1000-memory.dmp

        Filesize

        4KB

      • memory/1996-2-0x00000000006A0000-0x00000000006A1000-memory.dmp

        Filesize

        4KB

      • memory/1996-40-0x0000000000400000-0x0000000000573000-memory.dmp

        Filesize

        1.4MB

      • memory/1996-41-0x00000000005F0000-0x0000000000650000-memory.dmp

        Filesize

        384KB

      • memory/2728-38-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

      • memory/2728-39-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

      • memory/2728-35-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

      • memory/2728-31-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

      • memory/2728-29-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB