Analysis
-
max time kernel
168s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe
Resource
win10-20240404-en
General
-
Target
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe
-
Size
3.1MB
-
MD5
d3280c8db77e7d70bc80ad58e875dcf5
-
SHA1
e344a0bc5e42fba4ee4bd89827b46642481fb67c
-
SHA256
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93
-
SHA512
3c3bdb76929d39fc83fb244dca15ddf358bc1fa0d447d28c4996c5c389cd411c396b6ca20d0dd64728b6e8ab13591c538cfdc01acc3c62a04793243646c28d2c
-
SSDEEP
49152:I5cmt/rNUf4GLsBxS+8cY3L0FnpyDLuNblwy:I5c+/osBxnE4npOuNblh
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
5.42.65.92:27953
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2612-69-0x0000000000400000-0x0000000000450000-memory.dmp family_redline behavioral1/memory/2612-68-0x0000000000400000-0x0000000000450000-memory.dmp family_redline behavioral1/memory/2612-76-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exedescription pid process target process PID 1756 set thread context of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
MSBuild.exepid process 2612 MSBuild.exe 2612 MSBuild.exe 2612 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe Token: SeDebugPrivilege 2612 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exedescription pid process target process PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe PID 1756 wrote to memory of 2612 1756 adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe"C:\Users\Admin\AppData\Local\Temp\adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1756-40-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-10-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-2-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/1756-3-0x0000000005060000-0x000000000516A000-memory.dmpFilesize
1.0MB
-
memory/1756-4-0x0000000000900000-0x000000000091C000-memory.dmpFilesize
112KB
-
memory/1756-5-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-12-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-26-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-54-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-18-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-42-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-64-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-62-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-60-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-58-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-56-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-52-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-50-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-48-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-46-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-45-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-65-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/1756-0-0x000000007436E000-0x000000007436F000-memory.dmpFilesize
4KB
-
memory/1756-78-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/1756-30-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-34-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-32-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-36-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-28-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-24-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-22-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-21-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-16-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-14-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-1-0x0000000000CC0000-0x0000000000FE2000-memory.dmpFilesize
3.1MB
-
memory/1756-8-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-6-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/1756-38-0x0000000000900000-0x0000000000915000-memory.dmpFilesize
84KB
-
memory/2612-67-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2612-66-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2612-68-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2612-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2612-77-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2612-76-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2612-79-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2612-80-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2612-81-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB