Analysis
-
max time kernel
140s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-08-2021 11:13
General
-
Target
Vape Crack.exe
-
Size
796KB
-
MD5
a61f6f94009c04607f1ba923adcaba0d
-
SHA1
71b964ba1d7a6ddcebb9fadf29efba3f440c00af
-
SHA256
36022c868a49fc44968f6647239106f536b2cae40340ad69e3772f7be482daf7
-
SHA512
0d108e686fa33405b2deb127de0cb4ab60d9960d1af43ea4886496f8249c131da8a5a378b6f61b3d8e09179a295e2a7365b01d2db22d0fd916ce3190904a97dd
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
@bestiefFcs
C2
37.46.128.72:29799
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vape Crack.exe"C:\Users\Admin\AppData\Local\Temp\Vape Crack.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vape Crack.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB