Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 18:24
Static task
static1
Behavioral task
behavioral1
Sample
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
Resource
win7-20240705-en
General
-
Target
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
-
Size
963KB
-
MD5
1cc7ec4c91b811c75bb9621120b95dd4
-
SHA1
214a6276da8f2ead192d1cb28cf6afd514752eec
-
SHA256
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa
-
SHA512
af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0
-
SSDEEP
24576:KAHnh+eWsN3skA4RV1Hom2KXMmHaHfbSH5:dh+ZkldoPK8YaHf2
Malware Config
Extracted
redline
Windows
95.211.6.240:57887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1624-28-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1624-28-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Drops startup file 1 IoCs
Processes:
name.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid process 1484 name.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\directory\name.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
name.exedescription pid process target process PID 1484 set thread context of 1624 1484 name.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1624 RegSvcs.exe 1624 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
name.exepid process 1484 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1624 RegSvcs.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exename.exedescription pid process target process PID 4924 wrote to memory of 1484 4924 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe name.exe PID 4924 wrote to memory of 1484 4924 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe name.exe PID 4924 wrote to memory of 1484 4924 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe name.exe PID 1484 wrote to memory of 1624 1484 name.exe RegSvcs.exe PID 1484 wrote to memory of 1624 1484 name.exe RegSvcs.exe PID 1484 wrote to memory of 1624 1484 name.exe RegSvcs.exe PID 1484 wrote to memory of 1624 1484 name.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\plufferMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\tmpCE4D.tmpFilesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
C:\Users\Admin\AppData\Local\Temp\tmpCE63.tmpFilesize
114KB
MD5a2bc4eb3c67f34d75effa9bde49c2ffb
SHA1f38bf9e1468d1dd11a5d197c8befcbf9302e4e57
SHA256a2afda6ed0239af2873e61cffb2817572f9f5ce278b509d6c9c9e5f368a178e5
SHA51230fd383d5b385ffb7f6551ea64636189bfa090a9097e8373574c6dcf3c9e7bbc8c08035057a5565fd139dc505e1ca40cd83df477c2ee67a605d0a2cf8481dffe
-
C:\Users\Admin\AppData\Local\Temp\tmpCE8E.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmpCEA4.tmpFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Temp\tmpCEAA.tmpFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\tmpCED5.tmpFilesize
96KB
MD540f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1d6582ba879235049134fa9a351ca8f0f785d8835
SHA256cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2
-
C:\Users\Admin\AppData\Local\directory\name.exeFilesize
963KB
MD51cc7ec4c91b811c75bb9621120b95dd4
SHA1214a6276da8f2ead192d1cb28cf6afd514752eec
SHA25645546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa
SHA512af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0
-
memory/1624-31-0x0000000005980000-0x0000000005992000-memory.dmpFilesize
72KB
-
memory/1624-42-0x00000000073C0000-0x00000000073DE000-memory.dmpFilesize
120KB
-
memory/1624-35-0x0000000005C90000-0x0000000005D9A000-memory.dmpFilesize
1.0MB
-
memory/1624-36-0x0000000006D00000-0x0000000006EC2000-memory.dmpFilesize
1.8MB
-
memory/1624-37-0x0000000007400000-0x000000000792C000-memory.dmpFilesize
5.2MB
-
memory/1624-38-0x0000000006C80000-0x0000000006CE6000-memory.dmpFilesize
408KB
-
memory/1624-39-0x00000000071A0000-0x0000000007232000-memory.dmpFilesize
584KB
-
memory/1624-40-0x0000000007240000-0x00000000072B6000-memory.dmpFilesize
472KB
-
memory/1624-41-0x0000000007EE0000-0x0000000008484000-memory.dmpFilesize
5.6MB
-
memory/1624-34-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/1624-33-0x0000000005A20000-0x0000000005A6C000-memory.dmpFilesize
304KB
-
memory/1624-32-0x00000000059E0000-0x0000000005A1C000-memory.dmpFilesize
240KB
-
memory/1624-219-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/1624-30-0x0000000006110000-0x0000000006728000-memory.dmpFilesize
6.1MB
-
memory/1624-29-0x00000000748AE000-0x00000000748AF000-memory.dmpFilesize
4KB
-
memory/1624-28-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1624-218-0x00000000748AE000-0x00000000748AF000-memory.dmpFilesize
4KB
-
memory/4924-10-0x00000000041B0000-0x00000000041B4000-memory.dmpFilesize
16KB