Resubmissions
29-06-2024 09:31
240629-lg563sxglj 1029-06-2024 09:28
240629-lfeyhaxfrk 1029-06-2024 09:23
240629-lcqktsxfmk 10Analysis
-
max time kernel
33s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 09:23
Static task
static1
Behavioral task
behavioral1
Sample
Aura.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Aura.exe
Resource
win10v2004-20240508-en
General
-
Target
Aura.exe
-
Size
493KB
-
MD5
7e7b8be8a1f1ef05c932ea1e8eab6590
-
SHA1
f790227a5148d6cba037c24643306f330c6fe5f4
-
SHA256
c7383b039d569cc256026d6b7985bb763f36530708bca3e4f82fa130d2d7dfbb
-
SHA512
c57fc80bf97309ca887c88526fc586b080d47c4f2ebe611d40f94f48c0af2b7c56cec19f0379a5bc27bd6a0e2f75bdb7953c05bcc1069633812bbd22649ef890
-
SSDEEP
12288:qGlz1vS9p1+kOwILHmKfZcBg688m/Iezfihoto8:qyNSgJqBg6NmAeehn
Malware Config
Extracted
redline
@hitok4111
94.228.166.68:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3996-0-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Aura.exedescription pid process target process PID 924 set thread context of 3996 924 Aura.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3076 924 WerFault.exe Aura.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
RegAsm.exepid process 3996 RegAsm.exe 3996 RegAsm.exe 3996 RegAsm.exe 3996 RegAsm.exe 3996 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3996 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Aura.exedescription pid process target process PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe PID 924 wrote to memory of 3996 924 Aura.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aura.exe"C:\Users\Admin\AppData\Local\Temp\Aura.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 2762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 924 -ip 9241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/924-1-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/3996-8-0x0000000007910000-0x0000000007A1A000-memory.dmpFilesize
1.0MB
-
memory/3996-7-0x0000000005F80000-0x0000000006598000-memory.dmpFilesize
6.1MB
-
memory/3996-3-0x0000000004F60000-0x0000000005504000-memory.dmpFilesize
5.6MB
-
memory/3996-4-0x0000000004A90000-0x0000000004B22000-memory.dmpFilesize
584KB
-
memory/3996-9-0x0000000007820000-0x0000000007832000-memory.dmpFilesize
72KB
-
memory/3996-6-0x0000000074F60000-0x0000000075710000-memory.dmpFilesize
7.7MB
-
memory/3996-2-0x0000000074F6E000-0x0000000074F6F000-memory.dmpFilesize
4KB
-
memory/3996-0-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3996-5-0x0000000004C60000-0x0000000004C6A000-memory.dmpFilesize
40KB
-
memory/3996-10-0x0000000007880000-0x00000000078BC000-memory.dmpFilesize
240KB
-
memory/3996-11-0x0000000007A20000-0x0000000007A6C000-memory.dmpFilesize
304KB
-
memory/3996-12-0x0000000008990000-0x00000000089F6000-memory.dmpFilesize
408KB
-
memory/3996-13-0x00000000097B0000-0x0000000009800000-memory.dmpFilesize
320KB
-
memory/3996-14-0x0000000009010000-0x00000000091D2000-memory.dmpFilesize
1.8MB
-
memory/3996-15-0x0000000009F30000-0x000000000A45C000-memory.dmpFilesize
5.2MB
-
memory/3996-17-0x0000000074F60000-0x0000000075710000-memory.dmpFilesize
7.7MB