Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-12-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
tmp/vbc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp/vbc.exe
Resource
win10-en-20211208
General
-
Target
tmp/vbc.exe
-
Size
883KB
-
MD5
80bc1183c4d901de4fd1365eccd0f147
-
SHA1
d725b0664493a90ff4538bdc5f98d6161748e501
-
SHA256
f2b68fa107745b515e611eee99231eab7e03e022b4ff8af2bfe3b779ffbf61c4
-
SHA512
d62d9eae278c92f3041ebf63b38469465d4ecd3c555501b8dea73475d03572965af599455c75c34b3eb766212df0ba20a4a6c7c03ef262b38c871c4e29883385
Malware Config
Extracted
| Family |
redline |
| Botnet |
r1 |
| C2 |
101.99.93.44:21060 |
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload ⋅ 5 IoCs
Processes:
resource yara_rule behavioral1/memory/464-61-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/464-63-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/464-62-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/464-64-0x000000000041903E-mapping.dmp family_redline behavioral1/memory/464-65-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Uses the VBS compiler for execution ⋅ 1 TTPs
TTPs:
-
Suspicious use of SetThreadContext ⋅ 1 IoCs
Processes:
vbc.exedescription pid process target process PID 628 set thread context of 464 628 vbc.exe aspnet_regbrowsers.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 628 vbc.exe -
Suspicious use of WriteProcessMemory ⋅ 9 IoCs
Processes:
vbc.exedescription pid process target process PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe PID 628 wrote to memory of 464 628 vbc.exe aspnet_regbrowsers.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exePID:628"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"Suspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exePID:464"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
memory/464-59-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-60-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-61-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-63-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-62-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-64-0x000000000041903E-mapping.dmp
-
memory/464-65-0x0000000000400000-0x0000000000420000-memory.dmp
-
memory/464-67-0x00000000049A0000-0x00000000049A1000-memory.dmp
-
memory/628-54-0x0000000000C90000-0x0000000000C91000-memory.dmp
-
memory/628-56-0x00000000751B1000-0x00000000751B3000-memory.dmp
-
memory/628-57-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
-
memory/628-58-0x0000000000310000-0x000000000031F000-memory.dmp