Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
16-11-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe
Resource
win10-20220812-en
General
-
Target
466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe
-
Size
234KB
-
MD5
cce8615f9e697a298760ab4843b960fd
-
SHA1
e814ec411a2fb2cfed2a491ecc04f874035e98fa
-
SHA256
466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10
-
SHA512
4d7d99d910b0fddcf40f4099260163172eb05fe66fdcfec5935989a3746da2f560e57a92be375f73325caca167d5c8e6a73b52acec1f6812cadd5f044269c11e
-
SSDEEP
3072:fEPIO1y4Zn4rhuyJdBA/V0BV8lUkOnFXpnahpDI6RFlScQqiBAXgV0Bx92eedDys:f+ZnQ0gMqFl2cMlScQq192e+CfFBw
Malware Config
Extracted
redline
711
194.110.203.100:32796
-
auth_value
24e3340d853c89cad1e25194559ee778
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2092-137-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/2092-142-0x00000000004221D2-mapping.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exedescription pid process target process PID 3884 set thread context of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3984 3884 WerFault.exe 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 2092 vbc.exe 2092 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 2092 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exedescription pid process target process PID 3884 wrote to memory of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe PID 3884 wrote to memory of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe PID 3884 wrote to memory of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe PID 3884 wrote to memory of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe PID 3884 wrote to memory of 2092 3884 466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe"C:\Users\Admin\AppData\Local\Temp\466a20366f2f16813a26bdc6cce70a33d8c14bef069efbe24e0c028c9eb92c10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 3042⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2092-176-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-178-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-337-0x000000000CA80000-0x000000000CAD0000-memory.dmpFilesize
320KB
-
memory/2092-336-0x000000000C800000-0x000000000C876000-memory.dmpFilesize
472KB
-
memory/2092-244-0x000000000D510000-0x000000000DA3C000-memory.dmpFilesize
5.2MB
-
memory/2092-157-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-158-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-232-0x000000000CAE0000-0x000000000CFDE000-memory.dmpFilesize
5.0MB
-
memory/2092-231-0x000000000C540000-0x000000000C5D2000-memory.dmpFilesize
584KB
-
memory/2092-224-0x000000000BC00000-0x000000000BC66000-memory.dmpFilesize
408KB
-
memory/2092-215-0x0000000009700000-0x000000000974B000-memory.dmpFilesize
300KB
-
memory/2092-213-0x000000000B780000-0x000000000B7BE000-memory.dmpFilesize
248KB
-
memory/2092-211-0x000000000B720000-0x000000000B732000-memory.dmpFilesize
72KB
-
memory/2092-209-0x000000000B810000-0x000000000B91A000-memory.dmpFilesize
1.0MB
-
memory/2092-202-0x0000000009EB0000-0x000000000A4B6000-memory.dmpFilesize
6.0MB
-
memory/2092-182-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-181-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-180-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-179-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-177-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-174-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-173-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-137-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2092-142-0x00000000004221D2-mapping.dmp
-
memory/2092-143-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-144-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-145-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-147-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-149-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-150-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-152-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-153-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-154-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-155-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-156-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-172-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-243-0x000000000C8B0000-0x000000000CA72000-memory.dmpFilesize
1.8MB
-
memory/2092-162-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-161-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-160-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-159-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-163-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-165-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-164-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-166-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-167-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-168-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-169-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-170-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2092-171-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-115-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-116-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-132-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3884-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB