Analysis
-
max time kernel
61s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-08-2022 13:06
Static task
static1
Behavioral task
behavioral1
Sample
af477d25b88a0059ec73f7f595437162.exe
Resource
win7-20220812-en
General
-
Target
af477d25b88a0059ec73f7f595437162.exe
-
Size
163KB
-
MD5
af477d25b88a0059ec73f7f595437162
-
SHA1
7b13ff0f521763da35e136b910418f13d0b0fb88
-
SHA256
fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5
-
SHA512
304ae1af571f3f442b3945969476de810aec38e36affa87577ede7746704f13ae4bee0a870bed9ec1d055b7b34d4879af154eae6ebd9b127a545fea12c809624
Malware Config
Extracted
redline
V3Cryptex
194.36.177.60:81
-
auth_value
574bd465901175470b08af8d1a301beb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/276-58-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral1/memory/276-60-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral1/memory/276-61-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral1/memory/276-62-0x000000000041AE82-mapping.dmp family_redline behavioral1/memory/276-64-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral1/memory/276-66-0x0000000000400000-0x0000000000424000-memory.dmp family_redline -
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/988-72-0x00000000009E0000-0x00000000017F2000-memory.dmp family_ytstealer behavioral1/memory/988-73-0x00000000009E0000-0x00000000017F2000-memory.dmp family_ytstealer -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
22windows_64.exepid process 988 22windows_64.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\22windows_64.exe upx C:\Users\Admin\AppData\Local\Temp\22windows_64.exe upx \Users\Admin\AppData\Local\Temp\22windows_64.exe upx behavioral1/memory/988-72-0x00000000009E0000-0x00000000017F2000-memory.dmp upx behavioral1/memory/988-73-0x00000000009E0000-0x00000000017F2000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
vbc.exepid process 276 vbc.exe 276 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
af477d25b88a0059ec73f7f595437162.exedescription pid process target process PID 932 set thread context of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 276 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 276 vbc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
af477d25b88a0059ec73f7f595437162.exevbc.exedescription pid process target process PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 932 wrote to memory of 276 932 af477d25b88a0059ec73f7f595437162.exe vbc.exe PID 276 wrote to memory of 988 276 vbc.exe 22windows_64.exe PID 276 wrote to memory of 988 276 vbc.exe 22windows_64.exe PID 276 wrote to memory of 988 276 vbc.exe 22windows_64.exe PID 276 wrote to memory of 988 276 vbc.exe 22windows_64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af477d25b88a0059ec73f7f595437162.exe"C:\Users\Admin\AppData\Local\Temp\af477d25b88a0059ec73f7f595437162.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
memory/276-60-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-61-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-62-0x000000000041AE82-mapping.dmp
-
memory/276-64-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-66-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-67-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/276-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-56-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/276-55-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/932-54-0x0000000000FE0000-0x000000000100E000-memory.dmpFilesize
184KB
-
memory/988-70-0x0000000000000000-mapping.dmp
-
memory/988-72-0x00000000009E0000-0x00000000017F2000-memory.dmpFilesize
14.1MB
-
memory/988-73-0x00000000009E0000-0x00000000017F2000-memory.dmpFilesize
14.1MB