redline | 3e3fa8c5f5cc4ff95f439d86a4be759fbbc124e6655210d887459137d1c989db

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2022, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de08ba584af5b4baf2031410f9fd4201.exe
Size 234KB
Sample221119-av7fhsag2t
SHA256 3e3fa8c5f5cc4ff95f439d86a4be759fbbc124e6655210d887459137d1c989db
MD5 de08ba584af5b4baf2031410f9fd4201
SHA1 7b7ebcd40037a8ef8ba33d35eb45019510f23790
SHA512 9098bf411234d29726f5302f1d2dc7e8eefe7888e0818289e6cb8419b8c2e51a4b1b7f2c09e27c77c578f83263ca28517f6f168ab6da9b59caf29b502317c6d9
SSDEEP 6144:i4cRMLazRHsMgiqHxyBzqNJrhd02K2WB:iRMOzRMMyxyBzqbn02K2W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 638080521 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

638080521

45.15.157.135:13466

Attributes

auth_value
891b205a05e75276ad9187f93b1121f2

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2116-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	1116	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	vbc.exe
2116	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81
PID 1116 wrote to memory of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81
PID 1116 wrote to memory of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81
PID 1116 wrote to memory of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81
PID 1116 wrote to memory of 2116	1116	de08ba584af5b4baf2031410f9fd4201.exe	81

C:\Users\Admin\AppData\Local\Temp\de08ba584af5b4baf2031410f9fd4201.exe
"C:\Users\Admin\AppData\Local\Temp\de08ba584af5b4baf2031410f9fd4201.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 500
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1116 -ip 1116
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-133-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2116-138-0x0000000006090000-0x00000000066A8000-memory.dmp

Download

memory/2116-139-0x0000000005BF0000-0x0000000005CFA000-memory.dmp

Download

memory/2116-140-0x0000000005B20000-0x0000000005B32000-memory.dmp

Download

memory/2116-141-0x0000000005B80000-0x0000000005BBC000-memory.dmp

Download

memory/2116-142-0x0000000006C60000-0x0000000007204000-memory.dmp

Download

memory/2116-143-0x00000000066B0000-0x0000000006742000-memory.dmp

Download

memory/2116-144-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/2116-145-0x0000000007580000-0x0000000007742000-memory.dmp

Download

memory/2116-146-0x0000000007C80000-0x00000000081AC000-memory.dmp

Download