Analysis
-
max time kernel
90s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-06-2024 04:38
Static task
static1
Behavioral task
behavioral1
Sample
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
Resource
win10v2004-20240611-en
General
-
Target
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
-
Size
1.0MB
-
MD5
464709f3215d06f6703eb4ecb607ae7a
-
SHA1
1f438f2ab699f842cec119981ae5bf799df5d203
-
SHA256
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36
-
SHA512
007b3d6c7da18c9d8b31991520d18fa2ee323cf8b4d8ea153d74cf93d5bfb38df79bc65a968cc6e07c996c451f0f1c8b2a0b9f0529a6b67ca148cc27adf1eda9
-
SSDEEP
24576:3AHnh+eWsN3skA4RV1Hom2KXMmHaeAfg3sujtg5:qh+ZkldoPK8YaeAfTYg
Malware Config
Extracted
redline
wordfile
185.38.142.10:7474
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3384-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3384-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exedescription pid process target process PID 1060 set thread context of 3384 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 3384 RegSvcs.exe 3384 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exepid process 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3384 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exepid process 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exepid process 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exedescription pid process target process PID 1060 wrote to memory of 3384 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe RegSvcs.exe PID 1060 wrote to memory of 3384 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe RegSvcs.exe PID 1060 wrote to memory of 3384 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe RegSvcs.exe PID 1060 wrote to memory of 3384 1060 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe"C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9274.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp928A.tmpFilesize
100KB
MD51b576475cc2be38fe3683865f3bf5c25
SHA1f221c18c87a9d64ba1ec7d697adf7065b86f3f65
SHA256748c788f8de8a6c5a2238f675f7d2a2cd73d00b8cfff9baa3adef9aca7704b29
SHA5125b8c66cb876ad0ee993831ab116248dfd51c23185767dfb44956515b254b739b7a04f8bd7a4e56d74cad42e2e5f1163d25db4467696fe693ee315ef3d1320e87
-
C:\Users\Admin\AppData\Local\Temp\tmp92B5.tmpFilesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
C:\Users\Admin\AppData\Local\Temp\tmp92BB.tmpFilesize
20KB
MD522be08f683bcc01d7a9799bbd2c10041
SHA12efb6041cf3d6e67970135e592569c76fc4c41de
SHA256451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA5120eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
-
C:\Users\Admin\AppData\Local\Temp\tmp92D0.tmpFilesize
112KB
MD587210e9e528a4ddb09c6b671937c79c6
SHA13c75314714619f5b55e25769e0985d497f0062f2
SHA256eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
-
C:\Users\Admin\AppData\Local\Temp\tmp92FC.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
memory/1060-10-0x0000000003B20000-0x0000000003B24000-memory.dmpFilesize
16KB
-
memory/3384-20-0x0000000006FE0000-0x000000000750C000-memory.dmpFilesize
5.2MB
-
memory/3384-45-0x0000000006F10000-0x0000000006FA2000-memory.dmpFilesize
584KB
-
memory/3384-19-0x00000000068E0000-0x0000000006AA2000-memory.dmpFilesize
1.8MB
-
memory/3384-17-0x0000000074910000-0x00000000750C1000-memory.dmpFilesize
7.7MB
-
memory/3384-21-0x0000000006AB0000-0x0000000006B16000-memory.dmpFilesize
408KB
-
memory/3384-43-0x0000000007AC0000-0x0000000008066000-memory.dmpFilesize
5.6MB
-
memory/3384-44-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/3384-18-0x0000000005860000-0x000000000596A000-memory.dmpFilesize
1.0MB
-
memory/3384-46-0x0000000007610000-0x000000000762E000-memory.dmpFilesize
120KB
-
memory/3384-16-0x0000000005600000-0x000000000564C000-memory.dmpFilesize
304KB
-
memory/3384-15-0x00000000055C0000-0x00000000055FC000-memory.dmpFilesize
240KB
-
memory/3384-14-0x0000000005550000-0x0000000005562000-memory.dmpFilesize
72KB
-
memory/3384-13-0x0000000005BE0000-0x00000000061F8000-memory.dmpFilesize
6.1MB
-
memory/3384-12-0x000000007491E000-0x000000007491F000-memory.dmpFilesize
4KB
-
memory/3384-11-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3384-202-0x0000000074910000-0x00000000750C1000-memory.dmpFilesize
7.7MB