Analysis
-
max time kernel
52s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-08-2022 05:58
Static task
static1
Behavioral task
behavioral1
Sample
3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe
Resource
win10-20220812-en
General
-
Target
3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe
-
Size
400KB
-
MD5
fc71204fcbc5b045fc012e24511eb638
-
SHA1
3bbe58da84cd02356f323fa5be1d433ae4ecd299
-
SHA256
3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0
-
SHA512
07c381bde3b1e3863d8d22e6c37208f084e6d41de3d46ccbbfec4e31f857774b2ef055875e947d02a7bff2e60a49515576a1664dc6b0047439424149e04b8c84
-
SSDEEP
6144:dznqQNZgP4N2rJrx3wue4RwfqUKDPi5xo/nYH:NnqQNMte7I/nS
Malware Config
Extracted
redline
nam6.1
103.89.90.61:34589
-
auth_value
b5784d2217d2fd4ce7dab9bdb9fcaa62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2684-161-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2684-162-0x000000000041ADCA-mapping.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exedescription pid process target process PID 1468 set thread context of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 2684 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 2684 vbc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exedescription pid process target process PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe PID 1468 wrote to memory of 2684 1468 3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe"C:\Users\Admin\AppData\Local\Temp\3e3a73aea9495c7411a333fd99b00b2fe476894e7c3ac4486bcd1ca97cfcbfc0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-120-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-121-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-122-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-124-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-123-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-125-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-126-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-127-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-128-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-129-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-130-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-131-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-132-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-134-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-133-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-135-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-136-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-137-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-138-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-139-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-140-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-141-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-142-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-143-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-144-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-145-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-146-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-147-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-148-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-149-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-150-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-151-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-152-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-153-0x00000000006A0000-0x000000000070A000-memory.dmpFilesize
424KB
-
memory/1468-154-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-155-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-156-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-157-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-158-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-159-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-160-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/1468-163-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-161-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2684-162-0x000000000041ADCA-mapping.dmp
-
memory/2684-164-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-165-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-166-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-167-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-168-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-171-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-170-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-173-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-174-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-175-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-176-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-177-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-178-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-179-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-180-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-181-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-182-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-183-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-184-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-185-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-186-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-187-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2684-221-0x000000000A230000-0x000000000A836000-memory.dmpFilesize
6.0MB
-
memory/2684-223-0x000000000A040000-0x000000000A052000-memory.dmpFilesize
72KB
-
memory/2684-225-0x000000000BA90000-0x000000000BB9A000-memory.dmpFilesize
1.0MB
-
memory/2684-234-0x000000000BC00000-0x000000000BC3E000-memory.dmpFilesize
248KB
-
memory/2684-236-0x000000000BC40000-0x000000000BC8B000-memory.dmpFilesize
300KB
-
memory/2684-244-0x000000000CC10000-0x000000000D10E000-memory.dmpFilesize
5.0MB
-
memory/2684-248-0x000000000C7C0000-0x000000000C826000-memory.dmpFilesize
408KB
-
memory/2684-255-0x000000000C8B0000-0x000000000C926000-memory.dmpFilesize
472KB
-
memory/2684-256-0x000000000C9D0000-0x000000000CA62000-memory.dmpFilesize
584KB
-
memory/2684-258-0x000000000C970000-0x000000000C98E000-memory.dmpFilesize
120KB
-
memory/2684-506-0x000000000DC00000-0x000000000DDC2000-memory.dmpFilesize
1.8MB
-
memory/2684-507-0x000000000DDD0000-0x000000000E2FC000-memory.dmpFilesize
5.2MB
-
memory/2684-607-0x000000000D470000-0x000000000D4C0000-memory.dmpFilesize
320KB