Analysis
-
max time kernel
52s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15-11-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe
Resource
win10-20220812-en
General
-
Target
fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe
-
Size
590KB
-
MD5
d83c68b004860f9df81e16471daef592
-
SHA1
b0f94bcaa4c806b9a35d7b8762c0ec5abf25ae9c
-
SHA256
fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b
-
SHA512
a716c0d6069b40b5e829a2555fa7b834ceb06de52837ab512ef2915b4a9bfe225a0e10c40a2f44fac636b15a42b87c701c0ad4a81ea840d09e3e7b4ceadaf084
-
SSDEEP
12288:UqCRbKWcTFDCoXBSP8edJk0/9yVnuYptBP5xwVQjjw:Uf0SPJdJJ9MjPfwVQjU
Malware Config
Extracted
redline
1
107.182.129.73:21733
-
auth_value
3a5bb0917495b4312d052a0b8977d2bb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-125-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3016-130-0x000000000041ADAE-mapping.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exedescription pid process target process PID 392 set thread context of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 3016 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3016 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exedescription pid process target process PID 392 wrote to memory of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe PID 392 wrote to memory of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe PID 392 wrote to memory of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe PID 392 wrote to memory of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe PID 392 wrote to memory of 3016 392 fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe"C:\Users\Admin\AppData\Local\Temp\fbc2c0e4cd92c2baf24a96418c5598cc62bf11171e1bb7c423332c3f6782f37b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-119-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/392-120-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/392-121-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/392-122-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/392-123-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/392-124-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-125-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3016-130-0x000000000041ADAE-mapping.dmp
-
memory/3016-131-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-132-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-133-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-134-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-135-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-137-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-138-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-140-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-141-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-142-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-143-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-144-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-146-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-145-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-147-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-148-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-149-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-150-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-151-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-152-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-153-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-154-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-155-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-156-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-157-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-158-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-159-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-160-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-161-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-162-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-164-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-165-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-166-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-167-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-168-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-169-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-170-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-171-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-172-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-173-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-174-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-175-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-176-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-177-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-178-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-179-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-180-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-181-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-182-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-183-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-184-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-185-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-186-0x0000000009CD0000-0x000000000A2D6000-memory.dmpFilesize
6.0MB
-
memory/3016-187-0x00000000096E0000-0x00000000096F2000-memory.dmpFilesize
72KB
-
memory/3016-188-0x0000000009810000-0x000000000991A000-memory.dmpFilesize
1.0MB
-
memory/3016-189-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/3016-191-0x0000000009740000-0x000000000977E000-memory.dmpFilesize
248KB
-
memory/3016-193-0x0000000009780000-0x00000000097CB000-memory.dmpFilesize
300KB
-
memory/3016-202-0x0000000009AC0000-0x0000000009B26000-memory.dmpFilesize
408KB
-
memory/3016-210-0x000000000A5E0000-0x000000000A656000-memory.dmpFilesize
472KB
-
memory/3016-211-0x000000000A720000-0x000000000A7B2000-memory.dmpFilesize
584KB
-
memory/3016-212-0x000000000ACC0000-0x000000000B1BE000-memory.dmpFilesize
5.0MB
-
memory/3016-216-0x000000000A8C0000-0x000000000A8DE000-memory.dmpFilesize
120KB
-
memory/3016-469-0x000000000B390000-0x000000000B552000-memory.dmpFilesize
1.8MB
-
memory/3016-470-0x000000000BA90000-0x000000000BFBC000-memory.dmpFilesize
5.2MB
-
memory/3016-566-0x000000000B2F0000-0x000000000B340000-memory.dmpFilesize
320KB