redline | 84806d7ed59a57fce9b4bb07519d78f25edd45c5e56c5739a252f4b4b3c701e2

Analysis

max time kernel
186s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c02bf79ba67e69dfb5b5f115986f8b.exe
Size

242KB
MD5

63c02bf79ba67e69dfb5b5f115986f8b
SHA1

0282d75ca0ef8167e1798ab5925bdddf604753c9
SHA256

84806d7ed59a57fce9b4bb07519d78f25edd45c5e56c5739a252f4b4b3c701e2
SHA512

0b2923317ef6cd3b034f61a22ad47ea95a4bf4de6c5f11a04a22a638f6c6de7c5d80dd844f6608de40a746c40f7a3e468d8daba26f7f81807e8c6b0b3844ebea
SSDEEP

6144:71gE5wi2UCeNWGa+nMzVWMNQErpV2IviDnye3sEuYq7Z:pgEaACe1a+nMzVWMNQErpV2IvQypEuYa

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

37.220.87.2:27924

Attributes

auth_value
e457de0f8e67971846447e9d0f415966

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4888-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

63c02bf79ba67e69dfb5b5f115986f8b.exe

description pid process target process

PID 4708 set thread context of 4888 4708 63c02bf79ba67e69dfb5b5f115986f8b.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3172 4708 WerFault.exe 63c02bf79ba67e69dfb5b5f115986f8b.exe

description	pid	process	target process
PID 4708 set thread context of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe

pid	pid_target	process	target process
3172	4708	WerFault.exe	63c02bf79ba67e69dfb5b5f115986f8b.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

63c02bf79ba67e69dfb5b5f115986f8b.exe

description	pid	process	target process
PID 4708 wrote to memory of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe
PID 4708 wrote to memory of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe
PID 4708 wrote to memory of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe
PID 4708 wrote to memory of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe
PID 4708 wrote to memory of 4888	4708	63c02bf79ba67e69dfb5b5f115986f8b.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\63c02bf79ba67e69dfb5b5f115986f8b.exe
"C:\Users\Admin\AppData\Local\Temp\63c02bf79ba67e69dfb5b5f115986f8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 264
2⤵
- Program crash
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4708 -ip 4708
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-132-0x0000000000000000-mapping.dmp

Download
memory/4888-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4888-138-0x00000000058A0000-0x0000000005EB8000-memory.dmp

Filesize
6.1MB

Download
memory/4888-139-0x0000000005420000-0x000000000552A000-memory.dmp

Filesize
1.0MB

Download
memory/4888-140-0x0000000005350000-0x0000000005362000-memory.dmp

Filesize
72KB

Download
memory/4888-141-0x00000000053B0000-0x00000000053EC000-memory.dmp

Filesize
240KB

Download