Analysis

  • max time kernel
    134s
  • max time network
    181s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/11/2022, 16:30

General

  • Target

    74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64.exe

  • Size

    472KB

  • MD5

    4f784fd650c865f8363b7f314c20f4be

  • SHA1

    b1f016318068a4c59960254ca7560cfba550cd5c

  • SHA256

    74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64

  • SHA512

    c5abcd28932273def39c57210ef266b7a83898d9c02e3597c9d5a62e193acdafd0efce983c8ace838982110451276c63a3267d9569e08f6855da3d75b2acaec0

  • SSDEEP

    12288:S9s1Nb4P/ngZepriWeB7Ix0nV654ve3ySYX0vO+5N42FeVxCNm1arFSB+:BLsP/nuoaICV654ve3ySYX0vO+5N42FF

Malware Config

Extracted

Family

redline

C2

157.90.145.151:14075

Attributes
  • auth_value

    197a8d2e248bee4495c3db7cbfdf6d3d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64.exe
    "C:\Users\Admin\AppData\Local\Temp\74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 236
      2⤵
      • Program crash
      PID:2164

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/432-115-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/432-116-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/432-117-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/432-118-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/432-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/432-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-121-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/4420-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-128-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-143-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-144-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-156-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-162-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-163-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-164-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-165-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-167-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-168-0x0000000009540000-0x0000000009546000-memory.dmp

    Filesize

    24KB

  • memory/4420-169-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-170-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-171-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-172-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-174-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-175-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-176-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-179-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-182-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-183-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4420-187-0x000000000F3C0000-0x000000000F9C6000-memory.dmp

    Filesize

    6.0MB

  • memory/4420-188-0x000000000EF50000-0x000000000F05A000-memory.dmp

    Filesize

    1.0MB

  • memory/4420-190-0x000000000EE80000-0x000000000EE92000-memory.dmp

    Filesize

    72KB

  • memory/4420-192-0x000000000EEE0000-0x000000000EF1E000-memory.dmp

    Filesize

    248KB

  • memory/4420-194-0x000000000F060000-0x000000000F0AB000-memory.dmp

    Filesize

    300KB

  • memory/4420-203-0x000000000F200000-0x000000000F266000-memory.dmp

    Filesize

    408KB

  • memory/4420-211-0x000000000FD70000-0x000000000FE02000-memory.dmp

    Filesize

    584KB

  • memory/4420-212-0x0000000010310000-0x000000001080E000-memory.dmp

    Filesize

    5.0MB

  • memory/4420-216-0x000000000FF10000-0x000000000FF86000-memory.dmp

    Filesize

    472KB

  • memory/4420-217-0x000000000FE70000-0x000000000FEC0000-memory.dmp

    Filesize

    320KB

  • memory/4420-475-0x0000000011490000-0x0000000011652000-memory.dmp

    Filesize

    1.8MB

  • memory/4420-476-0x0000000011B90000-0x00000000120BC000-memory.dmp

    Filesize

    5.2MB