Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe
Resource
win10v2004-20221111-en
General
-
Target
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe
-
Size
389KB
-
MD5
f8f4e4588cda9a5837c3da5438c91fb3
-
SHA1
7276c3ec79da4bb0e4660f688e134906b56ff9dd
-
SHA256
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d
-
SHA512
d6ef2cf434f16c50b7eb0c723d3c3c68b2534768ae85b06feab4d79b40fb38eef6c6095b52c53ecc8bebd037eb0dab51da010087b99199b08be7052bd7d97377
-
SSDEEP
6144:TxsF/1PG8TgiRzfu3uFueouMbfMCL1aA6rEeyU3PiujfAuZJzP:TxsF/xGPiRlFUbECQfiuLAuZJ7
Malware Config
Extracted
redline
@andriii_ff
185.173.36.94:31511
-
auth_value
525a7ad8080b3552f2f7735af7644111
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exedescription pid process target process PID 4632 set thread context of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 3492 vbc.exe 3492 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3492 vbc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exedescription pid process target process PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe PID 4632 wrote to memory of 3492 4632 d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe"C:\Users\Admin\AppData\Local\Temp\d7d84bff7c0ac93a29ecd80481801303eb75b4b9ab0eb340d973cd8906f9340d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3492-140-0x0000000004DC0000-0x0000000004DFC000-memory.dmpFilesize
240KB
-
memory/3492-142-0x00000000058F0000-0x0000000005982000-memory.dmpFilesize
584KB
-
memory/3492-134-0x0000000000000000-mapping.dmp
-
memory/3492-135-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3492-147-0x0000000007CD0000-0x0000000007CEE000-memory.dmpFilesize
120KB
-
memory/3492-137-0x00000000052D0000-0x00000000058E8000-memory.dmpFilesize
6.1MB
-
memory/3492-146-0x0000000007D30000-0x0000000007DA6000-memory.dmpFilesize
472KB
-
memory/3492-138-0x0000000004D60000-0x0000000004D72000-memory.dmpFilesize
72KB
-
memory/3492-136-0x0000000000900000-0x0000000000936000-memory.dmpFilesize
216KB
-
memory/3492-141-0x0000000005EA0000-0x0000000006444000-memory.dmpFilesize
5.6MB
-
memory/3492-139-0x0000000004E90000-0x0000000004F9A000-memory.dmpFilesize
1.0MB
-
memory/3492-143-0x0000000006860000-0x0000000006A22000-memory.dmpFilesize
1.8MB
-
memory/3492-144-0x0000000006F60000-0x000000000748C000-memory.dmpFilesize
5.2MB
-
memory/3492-145-0x0000000006F10000-0x0000000006F60000-memory.dmpFilesize
320KB
-
memory/4632-133-0x0000000005080000-0x00000000050E6000-memory.dmpFilesize
408KB
-
memory/4632-132-0x00000000006E0000-0x0000000000748000-memory.dmpFilesize
416KB