redline | bba7be0678f2d6101ee7ad6bfb69f12c32bddebbdeefe27c8a07c7e744b240c8

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/10/2022, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3165acbd49e8be1e98508602a89a03d2.exe
Size 2.3MB
Sample221022-eyn6kaaeg9
SHA256 bba7be0678f2d6101ee7ad6bfb69f12c32bddebbdeefe27c8a07c7e744b240c8
MD5 3165acbd49e8be1e98508602a89a03d2
SHA1 bc1bc893bab57677ed6fc06ce197a01511e1bdb9
SHA512 14213c4a07bf4c499b04e0b527e26b2f35aa2035af052eb49bfb70af807e106a5d3bd642076aa26eb525e1a28a80ff9ea6df12cd01d2773198b34c5ca30c449a
SSDEEP 24576:tSN42YsYDkxX9M6UWYDhW+8JUtZgzqvIyfA0ajLLas7SDl3RuQ553132:tSXyP2ADfA0ajlSDl3c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 1340372385_99 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

1340372385_99

aliatabako.xyz:28786

Attributes

auth_value
c9aa9e634409f18a2984047a5d362a94

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
100692	vbc.exe
100692	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100692	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28
PID 368 wrote to memory of 100692	368	3165acbd49e8be1e98508602a89a03d2.exe	28

C:\Users\Admin\AppData\Local\Temp\3165acbd49e8be1e98508602a89a03d2.exe
"C:\Users\Admin\AppData\Local\Temp\3165acbd49e8be1e98508602a89a03d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:100692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-64-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/100692-54-0x0000000000080000-0x000000000009E000-memory.dmp

Download

memory/100692-56-0x0000000000080000-0x000000000009E000-memory.dmp

Download

memory/100692-62-0x0000000000080000-0x000000000009E000-memory.dmp

Download

memory/100692-63-0x0000000000080000-0x000000000009E000-memory.dmp

Download

memory/100692-65-0x0000000076401000-0x0000000076403000-memory.dmp

Download