Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
22-08-2022 07:58
Static task
static1
General
-
Target
fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe
-
Size
163KB
-
MD5
af477d25b88a0059ec73f7f595437162
-
SHA1
7b13ff0f521763da35e136b910418f13d0b0fb88
-
SHA256
fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5
-
SHA512
304ae1af571f3f442b3945969476de810aec38e36affa87577ede7746704f13ae4bee0a870bed9ec1d055b7b34d4879af154eae6ebd9b127a545fea12c809624
Malware Config
Extracted
redline
V3Cryptex
194.36.177.60:81
-
auth_value
574bd465901175470b08af8d1a301beb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4756-161-0x000000000041AE82-mapping.dmp family_redline behavioral1/memory/4756-160-0x0000000000400000-0x0000000000424000-memory.dmp family_redline -
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3628-657-0x00000000012A0000-0x00000000020B2000-memory.dmp family_ytstealer behavioral1/memory/3628-675-0x00000000012A0000-0x00000000020B2000-memory.dmp family_ytstealer -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
22windows_64.exepid process 3628 22windows_64.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\22windows_64.exe upx C:\Users\Admin\AppData\Local\Temp\22windows_64.exe upx behavioral1/memory/3628-656-0x00000000012A0000-0x00000000020B2000-memory.dmp upx behavioral1/memory/3628-657-0x00000000012A0000-0x00000000020B2000-memory.dmp upx behavioral1/memory/3628-675-0x00000000012A0000-0x00000000020B2000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exedescription pid process target process PID 3468 set thread context of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vbc.exepowershell.exepid process 4756 vbc.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exepowershell.exedescription pid process Token: SeDebugPrivilege 4756 vbc.exe Token: SeDebugPrivilege 4088 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exevbc.exe22windows_64.exedescription pid process target process PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 3468 wrote to memory of 4756 3468 fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe vbc.exe PID 4756 wrote to memory of 3628 4756 vbc.exe 22windows_64.exe PID 4756 wrote to memory of 3628 4756 vbc.exe 22windows_64.exe PID 3628 wrote to memory of 4088 3628 22windows_64.exe powershell.exe PID 3628 wrote to memory of 4088 3628 22windows_64.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe"C:\Users\Admin\AppData\Local\Temp\fae6e271a14675614d3d808555963b31b8e03bad2400f87f2cd2767628b077e5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
memory/3468-119-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-120-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-121-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-122-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-123-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-124-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-125-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-126-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-128-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-127-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-129-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-130-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-131-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-132-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-133-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-134-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-135-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-136-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-138-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-140-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-139-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-137-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-141-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-142-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-143-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-144-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-145-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-146-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-148-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-147-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-149-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-150-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-151-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-153-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-152-0x0000000000E70000-0x0000000000E9E000-memory.dmpFilesize
184KB
-
memory/3468-155-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-154-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-156-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-157-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-158-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-159-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3468-163-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/3628-648-0x0000000000000000-mapping.dmp
-
memory/3628-656-0x00000000012A0000-0x00000000020B2000-memory.dmpFilesize
14.1MB
-
memory/3628-675-0x00000000012A0000-0x00000000020B2000-memory.dmpFilesize
14.1MB
-
memory/3628-657-0x00000000012A0000-0x00000000020B2000-memory.dmpFilesize
14.1MB
-
memory/4088-667-0x000001CFE05E0000-0x000001CFE0656000-memory.dmpFilesize
472KB
-
memory/4088-664-0x000001CFDFA90000-0x000001CFDFAB2000-memory.dmpFilesize
136KB
-
memory/4088-658-0x0000000000000000-mapping.dmp
-
memory/4756-174-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-221-0x0000000009C60000-0x000000000A266000-memory.dmpFilesize
6.0MB
-
memory/4756-170-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-169-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-173-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-172-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-175-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-176-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-177-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-178-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-179-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-180-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-181-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-182-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-165-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-183-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-184-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-185-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-186-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-160-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4756-223-0x0000000009B40000-0x0000000009B52000-memory.dmpFilesize
72KB
-
memory/4756-227-0x000000000B4C0000-0x000000000B5CA000-memory.dmpFilesize
1.0MB
-
memory/4756-233-0x000000000B690000-0x000000000B6CE000-memory.dmpFilesize
248KB
-
memory/4756-235-0x000000000B6D0000-0x000000000B71B000-memory.dmpFilesize
300KB
-
memory/4756-266-0x000000000CB30000-0x000000000D02E000-memory.dmpFilesize
5.0MB
-
memory/4756-269-0x000000000C6A0000-0x000000000C706000-memory.dmpFilesize
408KB
-
memory/4756-276-0x000000000C790000-0x000000000C806000-memory.dmpFilesize
472KB
-
memory/4756-277-0x000000000C8B0000-0x000000000C942000-memory.dmpFilesize
584KB
-
memory/4756-167-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-166-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-164-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-162-0x0000000077740000-0x00000000778CE000-memory.dmpFilesize
1.6MB
-
memory/4756-161-0x000000000041AE82-mapping.dmp
-
memory/4756-279-0x000000000C850000-0x000000000C86E000-memory.dmpFilesize
120KB
-
memory/4756-526-0x000000000C9A0000-0x000000000C9F0000-memory.dmpFilesize
320KB
-
memory/4756-540-0x000000000DB20000-0x000000000DCE2000-memory.dmpFilesize
1.8MB
-
memory/4756-541-0x000000000E220000-0x000000000E74C000-memory.dmpFilesize
5.2MB