Malware Analysis Report

2024-08-06 01:43

Sample ID 211210-1gxl9sbdcp
Target Vape Cracked.exe
SHA256 30771966e27a617dec4499d5917d3fc8d4d3d67798c30c8b76a71238fbcfdfde
Tags
redline @dollax1337 discovery infostealer spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

30771966e27a617dec4499d5917d3fc8d4d3d67798c30c8b76a71238fbcfdfde

Threat Level: Known bad

The file Vape Cracked.exe was found to be: Known bad.

Malicious Activity Summary

redline @dollax1337 discovery infostealer spyware stealer

RedLine Payload

RedLine

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Credentials in Files
T1081
Discovery
TA0007
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2021-12-10 21:37

Signatures

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win10-en-20211208

Max time kernel

117s

Max time network

189s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 712 set thread context of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
US 52.109.8.21:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp
SC 185.215.113.82:31104 tcp
SC 185.215.113.82:31104 tcp

Files

memory/712-115-0x0000000000E70000-0x0000000000E71000-memory.dmp

memory/712-117-0x000000001BF30000-0x000000001BF32000-memory.dmp

memory/712-118-0x000000001BE10000-0x000000001BE11000-memory.dmp

memory/712-119-0x00000000017D0000-0x00000000017D1000-memory.dmp

memory/2684-120-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2684-121-0x000000000041A7AE-mapping.dmp

memory/2684-124-0x00000000052C0000-0x00000000052C1000-memory.dmp

memory/2684-125-0x0000000004D10000-0x0000000004D11000-memory.dmp

memory/2684-126-0x0000000004E40000-0x0000000004E41000-memory.dmp

memory/2684-127-0x0000000004D70000-0x0000000004D71000-memory.dmp

memory/2684-128-0x0000000004CB0000-0x00000000052B6000-memory.dmp

memory/2684-129-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

memory/2684-130-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

memory/2684-131-0x0000000005A90000-0x0000000005A91000-memory.dmp

memory/2684-132-0x0000000005D80000-0x0000000005D81000-memory.dmp

memory/2684-133-0x00000000063E0000-0x00000000063E1000-memory.dmp

memory/2684-134-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

memory/2684-135-0x0000000006970000-0x0000000006971000-memory.dmp

memory/2684-136-0x0000000007740000-0x0000000007741000-memory.dmp

memory/2684-137-0x0000000007E40000-0x0000000007E41000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win7-en-20211208

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1892 set thread context of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1892 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
SC 185.215.113.82:31104 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp

Files

memory/1892-54-0x0000000000B10000-0x0000000000B11000-memory.dmp

memory/1892-56-0x0000000000A60000-0x0000000000A62000-memory.dmp

memory/584-57-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-58-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-59-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-60-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-61-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-62-0x000000000041A7AE-mapping.dmp

memory/584-63-0x00000000751B1000-0x00000000751B3000-memory.dmp

memory/584-64-0x0000000000400000-0x0000000000420000-memory.dmp

memory/584-66-0x0000000000440000-0x0000000000441000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win10-en-20211208

Max time kernel

114s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3140 set thread context of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3140 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
US 52.109.8.20:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp
SC 185.215.113.82:31104 tcp

Files

memory/3140-115-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

memory/3140-117-0x0000000001730000-0x0000000001732000-memory.dmp

memory/3140-118-0x000000001BEE0000-0x000000001BEE1000-memory.dmp

memory/3140-119-0x0000000001760000-0x0000000001761000-memory.dmp

memory/3940-120-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3940-121-0x000000000041A7AE-mapping.dmp

memory/3940-124-0x0000000005A80000-0x0000000005A81000-memory.dmp

memory/3940-125-0x0000000005520000-0x0000000005521000-memory.dmp

memory/3940-126-0x0000000005650000-0x0000000005651000-memory.dmp

memory/3940-127-0x0000000005580000-0x0000000005581000-memory.dmp

memory/3940-128-0x0000000005470000-0x0000000005A76000-memory.dmp

memory/3940-129-0x00000000055C0000-0x00000000055C1000-memory.dmp

memory/3940-130-0x0000000005900000-0x0000000005901000-memory.dmp

memory/3940-131-0x0000000006890000-0x0000000006891000-memory.dmp

memory/3940-132-0x0000000006480000-0x0000000006481000-memory.dmp

memory/3940-133-0x00000000065A0000-0x00000000065A1000-memory.dmp

memory/3940-134-0x0000000006580000-0x0000000006581000-memory.dmp

memory/3940-135-0x0000000007A40000-0x0000000007A41000-memory.dmp

memory/3940-136-0x0000000007E60000-0x0000000007E61000-memory.dmp

memory/3940-137-0x0000000008030000-0x0000000008031000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win7-en-20211208

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 944 set thread context of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
SC 185.215.113.82:31104 tcp

Files

memory/944-53-0x0000000001280000-0x0000000001281000-memory.dmp

memory/944-55-0x000000001ACF0000-0x000000001ACF2000-memory.dmp

memory/1608-56-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-57-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-58-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-59-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-60-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-61-0x000000000041A7AE-mapping.dmp

memory/1608-62-0x0000000075D61000-0x0000000075D63000-memory.dmp

memory/1608-63-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-65-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win10-en-20211208

Max time kernel

66s

Max time network

179s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2092 set thread context of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2092 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
IE 52.109.76.30:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp
SC 185.215.113.82:31104 tcp

Files

memory/2092-115-0x0000000000B80000-0x0000000000B81000-memory.dmp

memory/2092-117-0x000000001BBF0000-0x000000001BBF2000-memory.dmp

memory/2092-118-0x000000001BC00000-0x000000001BC01000-memory.dmp

memory/2092-119-0x000000001BA50000-0x000000001BA51000-memory.dmp

memory/4032-120-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4032-121-0x000000000041A7AE-mapping.dmp

memory/4032-124-0x0000000005550000-0x0000000005551000-memory.dmp

memory/4032-125-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

memory/4032-126-0x0000000005100000-0x0000000005101000-memory.dmp

memory/4032-127-0x0000000005030000-0x0000000005031000-memory.dmp

memory/4032-128-0x0000000004F40000-0x0000000005546000-memory.dmp

memory/4032-129-0x0000000005070000-0x0000000005071000-memory.dmp

memory/4032-130-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/4032-131-0x0000000006360000-0x0000000006361000-memory.dmp

memory/4032-132-0x0000000005F30000-0x0000000005F31000-memory.dmp

memory/4032-133-0x0000000006050000-0x0000000006051000-memory.dmp

memory/4032-134-0x0000000006030000-0x0000000006031000-memory.dmp

memory/4032-135-0x00000000062E0000-0x00000000062E1000-memory.dmp

memory/4032-136-0x0000000006B30000-0x0000000006B31000-memory.dmp

memory/4032-137-0x0000000007230000-0x0000000007231000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2021-12-10 21:37

Reported

2021-12-10 21:43

Platform

win7-en-20211208

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

Signatures

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 976 set thread context of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 976 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe

"C:\Users\Admin\AppData\Local\Temp\Vape Cracked.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

#cmd

Network

Country Destination Domain Proto
SC 185.215.113.82:31104 tcp

Files

memory/976-54-0x0000000000E10000-0x0000000000E11000-memory.dmp

memory/976-56-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/628-57-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-58-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-59-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-60-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-61-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-62-0x000000000041A7AE-mapping.dmp

memory/628-63-0x0000000075761000-0x0000000075763000-memory.dmp

memory/628-64-0x0000000000400000-0x0000000000420000-memory.dmp

memory/628-66-0x0000000004D80000-0x0000000004D81000-memory.dmp