Analysis
- max time kernel
138s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
19/10/2022, 01:28
General
- Target qqq.exe
- Size 841KB
- Sample221019-bvntvaehfr
- SHA256 3d568dc9ee07bf5ebe9314d2aea822b1bf4de89110e7c027e151bde134b35ba5
Malware Config
Extracted
-
redline
-
Crypt_Cryptex_V1
-
194.36.177.60:81
-
auth_value
d8f662f9a9589a3ffdce7a16109ab9b7
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\qqq.exe"C:\Users\Admin\AppData\Local\Temp\qqq.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2076-132-0x0000000000FB0000-0x0000000001086000-memory.dmp
memory/3976-134-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3976-135-0x0000000005F50000-0x0000000006568000-memory.dmp
memory/3976-136-0x0000000005E30000-0x0000000005F3A000-memory.dmp
memory/3976-137-0x0000000005D60000-0x0000000005D72000-memory.dmp
memory/3976-138-0x00000000057B0000-0x00000000057EC000-memory.dmp
memory/3976-139-0x0000000008B30000-0x0000000008BC2000-memory.dmp
memory/3976-140-0x0000000009180000-0x0000000009724000-memory.dmp
memory/3976-141-0x0000000008C40000-0x0000000008CA6000-memory.dmp
memory/3976-142-0x00000000059D0000-0x0000000005A46000-memory.dmp
memory/3976-143-0x0000000005A50000-0x0000000005AA0000-memory.dmp
memory/3976-144-0x0000000008E80000-0x0000000009042000-memory.dmp
memory/3976-145-0x0000000009C60000-0x000000000A18C000-memory.dmp