redline | 09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mоdеst-mеnu.exe
Size

2.6MB
MD5

a5c547265ed07c915d1988ee7f44a14a
SHA1

593d43959ba2ec563adc948d1b26181752e10bbb
SHA256

09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993
SHA512

b3559e12540f6358840731652fe87bb05cf758555407bd9b93ce05e2158303facc8ea3cab04606bcbcce0c5905bd582ea3180e59741435b4daae4fca448ed504
SSDEEP

24576:ZHH7JxKgNhQuH8gG3APGGK/cRgOnmq9g6Nsp02P4goxZl3RuQ55313:BHFxrHH8gqGScOU7m6Nc0Ll3

Score

10^/10

redline @cham1ng infostealer

Malware Config

Extracted

Family

redline

Botnet

@cham1ng

193.106.191.160:8673

Attributes

auth_value
296c18e34d670ae41d67c9e09e2546b7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3644-135-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

mоdеst-mеnu.exe

description pid process target process

PID 4276 set thread context of 3644 4276 mоdеst-mеnu.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2344 4276 WerFault.exe mоdеst-mеnu.exe

description	pid	process	target process
PID 4276 set thread context of 3644	4276	mоdеst-mеnu.exe	vbc.exe

pid	pid_target	process	target process
2344	4276	WerFault.exe	mоdеst-mеnu.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

mоdеst-mеnu.exe

description	pid	process	target process
PID 4276 wrote to memory of 3644	4276	mоdеst-mеnu.exe	vbc.exe
PID 4276 wrote to memory of 3644	4276	mоdеst-mеnu.exe	vbc.exe
PID 4276 wrote to memory of 3644	4276	mоdеst-mеnu.exe	vbc.exe
PID 4276 wrote to memory of 3644	4276	mоdеst-mеnu.exe	vbc.exe
PID 4276 wrote to memory of 3644	4276	mоdеst-mеnu.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\mоdеst-mеnu.exe
"C:\Users\Admin\AppData\Local\Temp\mоdеst-mеnu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 344
2⤵
- Program crash
PID:2344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4276 -ip 4276
1⤵
PID:4996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-134-0x0000000000000000-mapping.dmp

Download
memory/3644-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3644-142-0x0000000006010000-0x0000000006628000-memory.dmp

Filesize
6.1MB

Download
memory/3644-143-0x0000000005B70000-0x0000000005C7A000-memory.dmp

Filesize
1.0MB

Download
memory/3644-144-0x0000000005AA0000-0x0000000005AB2000-memory.dmp

Filesize
72KB

Download
memory/3644-145-0x0000000005B00000-0x0000000005B3C000-memory.dmp

Filesize
240KB

Download
memory/4276-132-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4276-133-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4276-140-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4276-141-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download