redline | 9a4163962ab2a38aca13f1067ecc6c8a53f4ec906bbf4d51f575824ef438dab5

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
07/08/2022, 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sony Vegas crack/Setup.exe
Size

358KB
MD5

aaf3cdffc8c576e2de1cf8629e4f4864
SHA1

dda89a732e9de1af7742c54c5474eaa56250654e
SHA256

0ae5776317f4c8b71b190fbe5eec5a4f6709dab871635e5dbef4dbc06e9209a7
SHA512

6071528a51bae6e3d62fd617613d056c69bbd17c222630bbf22e06fb8b457bfcddd65fc528462d9920a476efb2f5addcf574f038540a9ac3436143e57497bc5f

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
2d8475d5a1e739364f1485cbb6b16870

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/171720-57-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/171720-62-0x000000000041B53E-mapping.dmp	family_redline
behavioral1/memory/171720-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/171720-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/952-82-0x0000000000170000-0x0000000000F49000-memory.dmp	family_ytstealer

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
171728	MainModule.exe
952	start.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014913-76.dat	upx
behavioral1/files/0x0006000000014913-77.dat	upx
behavioral1/files/0x0006000000014913-79.dat	upx
behavioral1/memory/952-82-0x0000000000170000-0x0000000000F49000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
171720	AppLaunch.exe
171728	MainModule.exe
171728	MainModule.exe
171720	AppLaunch.exe
171720	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 171720	1896	Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
171772	1896	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
171720	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	171720	AppLaunch.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171720	1896	Setup.exe	28
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 1896 wrote to memory of 171772	1896	Setup.exe	29
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 171728	171720	AppLaunch.exe	31
PID 171720 wrote to memory of 952	171720	AppLaunch.exe	32
PID 171720 wrote to memory of 952	171720	AppLaunch.exe	32
PID 171720 wrote to memory of 952	171720	AppLaunch.exe	32
PID 171720 wrote to memory of 952	171720	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\Sony Vegas crack\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Sony Vegas crack\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:171720
- - C:\Users\Admin\AppData\Local\Temp\MainModule.exe
    "C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:171728
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted.exe"
    3⤵
    PID:172128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 170616
  2⤵
  - Program crash
  PID:171772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
6a2c31f3e79e02f1c9cfd86856b3f500

SHA1
6dc720b0dde45798b8a87f45ffcfef14f62106d5

SHA256
1e61931d3d39560b2cc36e64db35a999158d63e68a253378598932e28a06e52e

SHA512
6ca3593b27cea6d8d3a8e85df292a9592792d8f396ef74a25e85f6e2f79eb15d20fbe0941f67052468153f23e89b046760e2fa9db151462932494e662a4e408a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
6a2c31f3e79e02f1c9cfd86856b3f500

SHA1
6dc720b0dde45798b8a87f45ffcfef14f62106d5

SHA256
1e61931d3d39560b2cc36e64db35a999158d63e68a253378598932e28a06e52e

SHA512
6ca3593b27cea6d8d3a8e85df292a9592792d8f396ef74a25e85f6e2f79eb15d20fbe0941f67052468153f23e89b046760e2fa9db151462932494e662a4e408a

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
b09ec6718a34a70a182f3412b89f6777

SHA1
e730645db18339897aeddb4f21ce662911e03444

SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2

SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881

Download Submit
\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
6a2c31f3e79e02f1c9cfd86856b3f500

SHA1
6dc720b0dde45798b8a87f45ffcfef14f62106d5

SHA256
1e61931d3d39560b2cc36e64db35a999158d63e68a253378598932e28a06e52e

SHA512
6ca3593b27cea6d8d3a8e85df292a9592792d8f396ef74a25e85f6e2f79eb15d20fbe0941f67052468153f23e89b046760e2fa9db151462932494e662a4e408a

Download Submit
\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
6a2c31f3e79e02f1c9cfd86856b3f500

SHA1
6dc720b0dde45798b8a87f45ffcfef14f62106d5

SHA256
1e61931d3d39560b2cc36e64db35a999158d63e68a253378598932e28a06e52e

SHA512
6ca3593b27cea6d8d3a8e85df292a9592792d8f396ef74a25e85f6e2f79eb15d20fbe0941f67052468153f23e89b046760e2fa9db151462932494e662a4e408a

Download Submit
\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
6a2c31f3e79e02f1c9cfd86856b3f500

SHA1
6dc720b0dde45798b8a87f45ffcfef14f62106d5

SHA256
1e61931d3d39560b2cc36e64db35a999158d63e68a253378598932e28a06e52e

SHA512
6ca3593b27cea6d8d3a8e85df292a9592792d8f396ef74a25e85f6e2f79eb15d20fbe0941f67052468153f23e89b046760e2fa9db151462932494e662a4e408a

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
b09ec6718a34a70a182f3412b89f6777

SHA1
e730645db18339897aeddb4f21ce662911e03444

SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2

SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
b09ec6718a34a70a182f3412b89f6777

SHA1
e730645db18339897aeddb4f21ce662911e03444

SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2

SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881

Download Submit
memory/952-82-0x0000000000170000-0x0000000000F49000-memory.dmp

Filesize
13.8MB

Download
memory/1896-54-0x0000000076081000-0x0000000076083000-memory.dmp

Filesize
8KB

Download
memory/171720-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/171720-80-0x0000000007950000-0x0000000008729000-memory.dmp

Filesize
13.8MB

Download
memory/171720-81-0x0000000007950000-0x0000000008729000-memory.dmp

Filesize
13.8MB

Download
memory/171720-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/171720-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/171720-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/171728-74-0x0000000000130000-0x0000000000148000-memory.dmp

Filesize
96KB

Download
memory/171728-75-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download