redline | 09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993

Analysis

max time kernel
101s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mоdеst-mеnu.exe
Size

2.6MB
MD5

a5c547265ed07c915d1988ee7f44a14a
SHA1

593d43959ba2ec563adc948d1b26181752e10bbb
SHA256

09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993
SHA512

b3559e12540f6358840731652fe87bb05cf758555407bd9b93ce05e2158303facc8ea3cab04606bcbcce0c5905bd582ea3180e59741435b4daae4fca448ed504
SSDEEP

24576:ZHH7JxKgNhQuH8gG3APGGK/cRgOnmq9g6Nsp02P4goxZl3RuQ55313:BHFxrHH8gqGScOU7m6Nc0Ll3

Score

10^/10

redline @cham1ng infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@cham1ng

193.106.191.160:8673

Attributes

auth_value
296c18e34d670ae41d67c9e09e2546b7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3848-136-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

mоdеst-mеnu.exe

description pid process target process

PID 4980 set thread context of 3848 4980 mоdеst-mеnu.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2472 4980 WerFault.exe mоdеst-mеnu.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

3848 vbc.exe
3848 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 3848 vbc.exe

description	pid	process	target process
PID 4980 set thread context of 3848	4980	mоdеst-mеnu.exe	vbc.exe

pid	pid_target	process	target process
2472	4980	WerFault.exe	mоdеst-mеnu.exe

pid	process
3848	vbc.exe
3848	vbc.exe

description	pid	process
Token: SeDebugPrivilege	3848	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

mоdеst-mеnu.exe

description	pid	process	target process
PID 4980 wrote to memory of 3848	4980	mоdеst-mеnu.exe	vbc.exe
PID 4980 wrote to memory of 3848	4980	mоdеst-mеnu.exe	vbc.exe
PID 4980 wrote to memory of 3848	4980	mоdеst-mеnu.exe	vbc.exe
PID 4980 wrote to memory of 3848	4980	mоdеst-mеnu.exe	vbc.exe
PID 4980 wrote to memory of 3848	4980	mоdеst-mеnu.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\mоdеst-mеnu.exe
"C:\Users\Admin\AppData\Local\Temp\mоdеst-mеnu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 344
2⤵
- Program crash
PID:2472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4980 -ip 4980
1⤵
PID:3536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3848-144-0x00000000054C0000-0x00000000055CA000-memory.dmp

Filesize
1.0MB

Download
memory/3848-149-0x0000000006360000-0x00000000063F2000-memory.dmp

Filesize
584KB

Download
memory/3848-145-0x00000000053F0000-0x0000000005402000-memory.dmp

Filesize
72KB

Download
memory/3848-146-0x0000000005450000-0x000000000548C000-memory.dmp

Filesize
240KB

Download
memory/3848-136-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3848-152-0x0000000007960000-0x0000000007B22000-memory.dmp

Filesize
1.8MB

Download
memory/3848-151-0x0000000007910000-0x0000000007960000-memory.dmp

Filesize
320KB

Download
memory/3848-143-0x0000000005960000-0x0000000005F78000-memory.dmp

Filesize
6.1MB

Download
memory/3848-153-0x0000000008060000-0x000000000858C000-memory.dmp

Filesize
5.2MB

Download
memory/3848-150-0x0000000007890000-0x0000000007906000-memory.dmp

Filesize
472KB

Download
memory/3848-135-0x0000000000000000-mapping.dmp

Download
memory/3848-147-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/3848-148-0x0000000006830000-0x0000000006DD4000-memory.dmp

Filesize
5.6MB

Download
memory/4980-141-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4980-134-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Filesize
384KB

Download
memory/4980-142-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Filesize
384KB

Download
memory/4980-133-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4980-132-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download