Analysis
-
max time kernel
91s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 22:00
Static task
static1
Behavioral task
behavioral1
Sample
vvv.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
vvv.exe
Resource
win10v2004-20220812-en
General
-
Target
vvv.exe
-
Size
241KB
-
MD5
aca124c45a891c1ef397d8f417321b18
-
SHA1
df65ba744946b458692d3b9e8a7c751f5ce4905d
-
SHA256
f8d62ab41ce1346a6b65b18bab3b87d35143ccdcf680628738c22817987efd70
-
SHA512
979ddbe803c338022650aec8c1c9f90dbb0285e1c1cafcd0c2061bbb4e9ea73b01ecae8ee24da109d943d8a935a26281b595d5aa08e8b47133b12f1094f458d8
-
SSDEEP
6144:L7OMdwUrnuMego2pbulGRd63fU9U79ltVswVmv/8bD0N:L7OMd1rFslGGc9U7m
Malware Config
Extracted
redline
Crypt_Cryptex
194.36.177.60:81
-
auth_value
695fd213fb1982a368936f037db38e54
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1968-134-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4124-150-0x00000000000A0000-0x0000000000EB2000-memory.dmp family_ytstealer behavioral2/memory/4124-155-0x00000000000A0000-0x0000000000EB2000-memory.dmp family_ytstealer -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
22windows_64.exepid process 4124 22windows_64.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\22windows_64.exe upx C:\Users\Admin\AppData\Local\Temp\22windows_64.exe upx behavioral2/memory/4124-149-0x00000000000A0000-0x0000000000EB2000-memory.dmp upx behavioral2/memory/4124-150-0x00000000000A0000-0x0000000000EB2000-memory.dmp upx behavioral2/memory/4124-155-0x00000000000A0000-0x0000000000EB2000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vvv.exedescription pid process target process PID 4040 set thread context of 1968 4040 vvv.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vbc.exepowershell.exepid process 1968 vbc.exe 1968 vbc.exe 3772 powershell.exe 3772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exepowershell.exedescription pid process Token: SeDebugPrivilege 1968 vbc.exe Token: SeDebugPrivilege 3772 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
vvv.exevbc.exe22windows_64.exedescription pid process target process PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 4040 wrote to memory of 1968 4040 vvv.exe vbc.exe PID 1968 wrote to memory of 4124 1968 vbc.exe 22windows_64.exe PID 1968 wrote to memory of 4124 1968 vbc.exe 22windows_64.exe PID 4124 wrote to memory of 3772 4124 22windows_64.exe powershell.exe PID 4124 wrote to memory of 3772 4124 22windows_64.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vvv.exe"C:\Users\Admin\AppData\Local\Temp\vvv.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exeFilesize
4.0MB
MD5eaaad4f36853f423ee62272e125708ff
SHA171c045b6a66fef5dd1f20faefbce8df88c890788
SHA2561901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
SHA51205292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431
-
memory/1968-144-0x0000000008A30000-0x0000000008AA6000-memory.dmpFilesize
472KB
-
memory/1968-136-0x0000000007FA0000-0x00000000080AA000-memory.dmpFilesize
1.0MB
-
memory/1968-145-0x00000000086B0000-0x0000000008700000-memory.dmpFilesize
320KB
-
memory/1968-137-0x0000000007EF0000-0x0000000007F02000-memory.dmpFilesize
72KB
-
memory/1968-138-0x0000000007F50000-0x0000000007F8C000-memory.dmpFilesize
240KB
-
memory/1968-139-0x00000000083D0000-0x0000000008436000-memory.dmpFilesize
408KB
-
memory/1968-140-0x0000000009050000-0x00000000095F4000-memory.dmpFilesize
5.6MB
-
memory/1968-141-0x00000000084F0000-0x0000000008582000-memory.dmpFilesize
584KB
-
memory/1968-133-0x0000000000000000-mapping.dmp
-
memory/1968-143-0x0000000009B30000-0x000000000A05C000-memory.dmpFilesize
5.2MB
-
memory/1968-134-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1968-135-0x0000000006610000-0x0000000006C28000-memory.dmpFilesize
6.1MB
-
memory/1968-142-0x0000000008760000-0x0000000008922000-memory.dmpFilesize
1.8MB
-
memory/3772-151-0x0000000000000000-mapping.dmp
-
memory/3772-152-0x000002DDFDAA0000-0x000002DDFDAC2000-memory.dmpFilesize
136KB
-
memory/3772-153-0x00007FFF39730000-0x00007FFF3A1F1000-memory.dmpFilesize
10.8MB
-
memory/3772-154-0x00007FFF39730000-0x00007FFF3A1F1000-memory.dmpFilesize
10.8MB
-
memory/4040-132-0x0000000000B20000-0x0000000000B62000-memory.dmpFilesize
264KB
-
memory/4124-155-0x00000000000A0000-0x0000000000EB2000-memory.dmpFilesize
14.1MB
-
memory/4124-146-0x0000000000000000-mapping.dmp
-
memory/4124-149-0x00000000000A0000-0x0000000000EB2000-memory.dmpFilesize
14.1MB
-
memory/4124-150-0x00000000000A0000-0x0000000000EB2000-memory.dmpFilesize
14.1MB