Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe
Resource
win10v2004-20240611-en
General
-
Target
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe
-
Size
1.6MB
-
MD5
1238ef00e11f44c07643ce7a216e4c38
-
SHA1
e70f86cefc7616f665b2c50b08c1b82a8bb9bdae
-
SHA256
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c
-
SHA512
5dd4fe8f54c5075669a5910f47cc812a682d72676f6896432f248e5c970a57c3874909ddd82ace1e5da200d6914a751a0796351e6de42ee3e483d6eeaedea9f0
-
SSDEEP
49152:FTB9HVBO0Z9rqyI44HppuzGxHHYh1PYHlvsz:FTB00Z92yVG/uzGNmP
Malware Config
Extracted
redline
@nmrzv88
94.228.166.68:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3296-8-0x00000000001A0000-0x00000000001F0000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
Processes:
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exepid process 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exedescription pid process target process PID 1560 set thread context of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
MSBuild.exepid process 3296 MSBuild.exe 3296 MSBuild.exe 3296 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 3296 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exedescription pid process target process PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe PID 1560 wrote to memory of 3296 1560 6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe"C:\Users\Admin\AppData\Local\Temp\6195a3c9648da3f992dc8c3b0b96a0169916c5db5d9ee78983a693d8f37d135c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\d3d9.dllFilesize
424KB
MD53fd642074c5797cbc8b9ddf6fa07ea94
SHA1bfb0f8e7f583683ea898f69b663c64c3acede795
SHA256debc93c44e7d636287a1cb5ab031d6df309fb4b0d83ba2362f80b9cd88ad0c56
SHA512aa65b27790c92e06ac1586d15ae973bf2e70fa4b2d6cad27c5867477a1cf2338d5c1ee5cbec1a04703a123db4b14efed527d91713ec7408b5a9f9dd4e7c17d39
-
memory/1560-11-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/1560-1-0x0000000000F60000-0x00000000010F4000-memory.dmpFilesize
1.6MB
-
memory/1560-28-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/1560-0-0x000000007449E000-0x000000007449F000-memory.dmpFilesize
4KB
-
memory/3296-16-0x0000000005FD0000-0x00000000065E8000-memory.dmpFilesize
6.1MB
-
memory/3296-20-0x0000000007960000-0x00000000079AC000-memory.dmpFilesize
304KB
-
memory/3296-13-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/3296-14-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/3296-15-0x0000000004A10000-0x0000000004A1A000-memory.dmpFilesize
40KB
-
memory/3296-10-0x0000000005000000-0x00000000055A4000-memory.dmpFilesize
5.6MB
-
memory/3296-17-0x0000000007850000-0x000000000795A000-memory.dmpFilesize
1.0MB
-
memory/3296-18-0x0000000005EF0000-0x0000000005F02000-memory.dmpFilesize
72KB
-
memory/3296-19-0x0000000005F50000-0x0000000005F8C000-memory.dmpFilesize
240KB
-
memory/3296-12-0x0000000004A50000-0x0000000004AE2000-memory.dmpFilesize
584KB
-
memory/3296-21-0x00000000083E0000-0x0000000008446000-memory.dmpFilesize
408KB
-
memory/3296-22-0x00000000086A0000-0x00000000086F0000-memory.dmpFilesize
320KB
-
memory/3296-23-0x00000000088C0000-0x0000000008A82000-memory.dmpFilesize
1.8MB
-
memory/3296-24-0x0000000008FC0000-0x00000000094EC000-memory.dmpFilesize
5.2MB
-
memory/3296-25-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/3296-27-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/3296-8-0x00000000001A0000-0x00000000001F0000-memory.dmpFilesize
320KB