Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2022 06:57
Static task
static1
Behavioral task
behavioral1
Sample
c296e11ddc734939a1b44be2deb19f69.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c296e11ddc734939a1b44be2deb19f69.exe
Resource
win10v2004-20220901-en
General
-
Target
c296e11ddc734939a1b44be2deb19f69.exe
-
Size
245KB
-
MD5
c296e11ddc734939a1b44be2deb19f69
-
SHA1
f35d071156e81ffc48f6b953754bac20ef4fb318
-
SHA256
065cbf8a5650089f83b6187da6fe90741e5b8c9d645159c4c42480ac8734719b
-
SHA512
c893eeb405efa82543518b8f019c278e1f88e499da1e4fc9f1c714d182f03d1cd93e5f40adef69f41510f9292a6ed13ddcaa510c3c99001b4f204ba4baadd29e
-
SSDEEP
6144:qrNrKSzixoeEgMCtjLctzA1jqb7ZdGWDzkCuYqLB:wrKKiee1tjLctzA1jqb7ZdGWXNuYq
Malware Config
Extracted
redline
1
79.137.196.94:48705
-
auth_value
6a4b05ef943a0dd801fd01dfbb9eb717
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4568-133-0x0000000000A00000-0x0000000000A28000-memory.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c296e11ddc734939a1b44be2deb19f69.exedescription pid process target process PID 4284 set thread context of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2740 4284 WerFault.exe c296e11ddc734939a1b44be2deb19f69.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 4568 vbc.exe 4568 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4568 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c296e11ddc734939a1b44be2deb19f69.exedescription pid process target process PID 4284 wrote to memory of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe PID 4284 wrote to memory of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe PID 4284 wrote to memory of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe PID 4284 wrote to memory of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe PID 4284 wrote to memory of 4568 4284 c296e11ddc734939a1b44be2deb19f69.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c296e11ddc734939a1b44be2deb19f69.exe"C:\Users\Admin\AppData\Local\Temp\c296e11ddc734939a1b44be2deb19f69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 2642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4284 -ip 42841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4568-132-0x0000000000000000-mapping.dmp
-
memory/4568-133-0x0000000000A00000-0x0000000000A28000-memory.dmpFilesize
160KB
-
memory/4568-138-0x0000000005580000-0x0000000005B98000-memory.dmpFilesize
6.1MB
-
memory/4568-139-0x00000000050B0000-0x00000000051BA000-memory.dmpFilesize
1.0MB
-
memory/4568-140-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/4568-141-0x0000000005040000-0x000000000507C000-memory.dmpFilesize
240KB
-
memory/4568-142-0x00000000053A0000-0x0000000005406000-memory.dmpFilesize
408KB
-
memory/4568-143-0x0000000006450000-0x00000000069F4000-memory.dmpFilesize
5.6MB
-
memory/4568-144-0x0000000005F40000-0x0000000005FD2000-memory.dmpFilesize
584KB
-
memory/4568-145-0x0000000007680000-0x0000000007842000-memory.dmpFilesize
1.8MB
-
memory/4568-146-0x0000000007D80000-0x00000000082AC000-memory.dmpFilesize
5.2MB
-
memory/4568-147-0x0000000006BE0000-0x0000000006C56000-memory.dmpFilesize
472KB
-
memory/4568-148-0x0000000006C60000-0x0000000006CB0000-memory.dmpFilesize
320KB