Analysis

  • max time kernel
    45s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 18:06

General

  • Target

    file.exe

  • Size

    209KB

  • MD5

    4f6f1e21166488e9c7e1b395051bbd9d

  • SHA1

    74e4378d17d36bbaffabb024e50e57be735d8b32

  • SHA256

    538b97821cb7545514296decdcfe474717ce95648c4260da497bfd233aa99ffc

  • SHA512

    24e0f9aa61d35b754d1fe26a4a4a44da657f196d7662f6d2cc26ae7f24d44a80d47de8d202d20c32c67d176ffc2a783805564a81ee7e5efabd5537ebd1aceb84

  • SSDEEP

    3072:Pz0Rj65siQRWyvWY0tKtC+m/7izn19CagF/aBQf9bSlx8uqCUM0MbtWuu9xGEFV:Pzw6CiQIY04Ev/7iYVJ9bevUM0EfEd

Malware Config

Extracted

Family

redline

Botnet

newlogs

C2

77.73.133.70:38819

Attributes
  • auth_value

    05a73a1692c3aebb2a26f1a593237a77

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1704-54-0x0000000000080000-0x00000000000A8000-memory.dmp
    Filesize

    160KB

  • memory/1704-56-0x0000000000080000-0x00000000000A8000-memory.dmp
    Filesize

    160KB

  • memory/1704-61-0x00000000000A218E-mapping.dmp
  • memory/1704-63-0x0000000000080000-0x00000000000A8000-memory.dmp
    Filesize

    160KB

  • memory/1704-62-0x0000000000080000-0x00000000000A8000-memory.dmp
    Filesize

    160KB

  • memory/1704-64-0x0000000075B51000-0x0000000075B53000-memory.dmp
    Filesize

    8KB