Analysis
-
max time kernel
136s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 18:06
Static task
static1
Behavioral task
behavioral1
Sample
excellent.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
General
-
Target
excellent.exe
-
Size
296KB
-
MD5
efad4f96f696391769ef9944978dbb3b
-
SHA1
42ad30f7af140544eaeb8cc32d8fe5568aca8944
-
SHA256
26e9f0c78dde027c60eeacca5852a8f08853c440048ae45cbb054fd12e0cddd2
-
SHA512
427b793cd433be1251d8348a5d788ff4c927c5c78c6d2ad15a5de4de64f57e1c0182534d180de388734e28a4563f1b92fc30f1365356bd2fe6546beaf6da9da4
-
SSDEEP
6144:KL4miZW6NAIn7RMWhrWzMCx5T2exIT4tifYfcDVn0Q0+A9b/pcvEV:KEI5I7XCMCx5T2exIT4tifYfcDVn0Q0n
Malware Config
Extracted
redline
6627938439_99
https://t.me/+J_Z1QGHfHko0MGZi*https://steamcommunity.com/id/elcadillac
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3740-9-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
Processes:
excellent.exepid process 2328 excellent.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
excellent.exedescription pid process target process PID 2328 set thread context of 3740 2328 excellent.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
MSBuild.exepid process 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe 3740 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 3740 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
excellent.exedescription pid process target process PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe PID 2328 wrote to memory of 3740 2328 excellent.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\excellent.exe"C:\Users\Admin\AppData\Local\Temp\excellent.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\d3d9.dllFilesize
231KB
MD540ac80e3b938041fb1af40368973ac95
SHA1076439ed562ea031ae1dfbe0693e5d5d7f75850c
SHA256035fdc6610474b861796d4f96c9f8f9ea2a74e9ccbc1d9d718f434ca638f6ca6
SHA512c458bfefebcf831933befb5bb3193733c09176157e2c602f321db8ec7577d93ddf58430cd8b042e2f9fe086ef90e3d40e570b2b9f43cdbbc299db18e93426bad
-
memory/2328-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmpFilesize
4KB
-
memory/2328-1-0x0000000000030000-0x0000000000084000-memory.dmpFilesize
336KB
-
memory/2328-2-0x0000000000A40000-0x0000000000A46000-memory.dmpFilesize
24KB
-
memory/2328-30-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/2328-11-0x0000000077851000-0x0000000077971000-memory.dmpFilesize
1.1MB
-
memory/2328-12-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3740-18-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3740-22-0x00000000075F0000-0x0000000007B1C000-memory.dmpFilesize
5.2MB
-
memory/3740-15-0x0000000006320000-0x0000000006938000-memory.dmpFilesize
6.1MB
-
memory/3740-16-0x0000000005D80000-0x0000000005D92000-memory.dmpFilesize
72KB
-
memory/3740-17-0x0000000005EB0000-0x0000000005FBA000-memory.dmpFilesize
1.0MB
-
memory/3740-13-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/3740-19-0x0000000006B80000-0x0000000006BBC000-memory.dmpFilesize
240KB
-
memory/3740-20-0x0000000006BC0000-0x0000000006C0C000-memory.dmpFilesize
304KB
-
memory/3740-21-0x0000000006EF0000-0x00000000070B2000-memory.dmpFilesize
1.8MB
-
memory/3740-14-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3740-23-0x00000000080D0000-0x0000000008674000-memory.dmpFilesize
5.6MB
-
memory/3740-24-0x00000000070C0000-0x0000000007152000-memory.dmpFilesize
584KB
-
memory/3740-25-0x0000000007EB0000-0x0000000007F26000-memory.dmpFilesize
472KB
-
memory/3740-26-0x0000000007410000-0x000000000742E000-memory.dmpFilesize
120KB
-
memory/3740-27-0x0000000007FC0000-0x0000000008010000-memory.dmpFilesize
320KB
-
memory/3740-29-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3740-9-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB