Analysis
- max time kernel
132s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
15/09/2024, 15:26
General
- Target SecuriteInfo.com.Trojan.PWS.RedLineNET.9.13539.22104.exe
- Size 323KB
- Sample240915-svfa5szena
- SHA256 137b72cbe967bf65ce417d0fe59a853bb9cf0a314086614c61fbe4345b3eeff8
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
5.42.92.222:7880
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.9.13539.22104.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.9.13539.22104.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
TmpC9F7.tmp
memory/1252-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp
memory/1252-1-0x00000000005C0000-0x0000000000614000-memory.dmp
memory/1252-36-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/1252-5-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/4592-10-0x00000000051F0000-0x00000000051FA000-memory.dmp
memory/4592-31-0x0000000006D70000-0x0000000007388000-memory.dmp
memory/4592-9-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/4592-7-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/4592-6-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/4592-27-0x0000000005FA0000-0x0000000006016000-memory.dmp
memory/4592-28-0x0000000006730000-0x000000000674E000-memory.dmp
memory/4592-8-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/4592-32-0x00000000068C0000-0x00000000069CA000-memory.dmp
memory/4592-33-0x0000000006800000-0x0000000006812000-memory.dmp
memory/4592-34-0x0000000006860000-0x000000000689C000-memory.dmp
memory/4592-35-0x00000000069D0000-0x0000000006A1C000-memory.dmp
memory/4592-3-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4592-37-0x0000000074D70000-0x0000000075520000-memory.dmp