Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 17:34
Static task
static1
Behavioral task
behavioral1
Sample
Yc3OSkUSm5dLQY906NXrU_Xf.exe
Resource
win7-20240704-en
General
-
Target
Yc3OSkUSm5dLQY906NXrU_Xf.exe
-
Size
589KB
-
MD5
34c76bcc1506b513c7a1ac605c045c4e
-
SHA1
271c6b3853e33e039242da7cf8f4465c48e90d2e
-
SHA256
1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
-
SHA512
cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
SSDEEP
12288:fhdKHkwkYGXXRJRC7ijHRAWteLwnHdYnXQ6mr4ZFrUD:fzKYQv
Malware Config
Extracted
redline
23.08
95.181.172.100:55640
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2452-6-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2452-6-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Yc3OSkUSm5dLQY906NXrU_Xf.exedescription pid process target process PID 1732 set thread context of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Yc3OSkUSm5dLQY906NXrU_Xf.exedescription pid process target process PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe PID 1732 wrote to memory of 2452 1732 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe"C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exeC:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-9-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/1732-4-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/1732-0-0x000000007449E000-0x000000007449F000-memory.dmpFilesize
4KB
-
memory/1732-3-0x0000000003420000-0x000000000343E000-memory.dmpFilesize
120KB
-
memory/1732-1-0x0000000000EC0000-0x0000000000F5A000-memory.dmpFilesize
616KB
-
memory/1732-5-0x0000000006010000-0x00000000065B4000-memory.dmpFilesize
5.6MB
-
memory/1732-2-0x0000000005910000-0x0000000005986000-memory.dmpFilesize
472KB
-
memory/2452-12-0x0000000005440000-0x0000000005452000-memory.dmpFilesize
72KB
-
memory/2452-6-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2452-10-0x0000000005350000-0x00000000053E2000-memory.dmpFilesize
584KB
-
memory/2452-8-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/2452-11-0x00000000063E0000-0x00000000069F8000-memory.dmpFilesize
6.1MB
-
memory/2452-13-0x00000000055F0000-0x00000000056FA000-memory.dmpFilesize
1.0MB
-
memory/2452-14-0x0000000005740000-0x000000000577C000-memory.dmpFilesize
240KB
-
memory/2452-15-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/2452-16-0x00000000062F0000-0x000000000633C000-memory.dmpFilesize
304KB
-
memory/2452-17-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB