Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
29-11-2022 16:00
Static task
static1
Behavioral task
behavioral1
Sample
1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe
Resource
win10-20220901-en
General
-
Target
1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe
-
Size
216KB
-
MD5
f26954c64a0af9a97ff35355dfc233a0
-
SHA1
6da41827230a917ef747cdee06e2e104d5168127
-
SHA256
1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01
-
SHA512
de216842dab46a2ab49ee3e4739e7cc47ee7fd13e2641e8722f06a96b920725dd90209f3cdc668669a7d752624d36698508094938711640905c9f9d7d5b34a87
-
SSDEEP
3072:xhbc8yCxsFNcEyyrJ9WU4khLTvPZFzD0yfZNuzK/hRp1d53CDX5dINLqVqU:GCxGNp7FUyf2AhZjwINut
Malware Config
Extracted
redline
@P1
193.106.191.138:32796
-
auth_value
54c79ce081122137049ee07c0a2f38ab
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3700-146-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/3700-151-0x00000000004221CA-mapping.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exedescription pid process target process PID 388 set thread context of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 3700 vbc.exe 3700 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3700 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exedescription pid process target process PID 388 wrote to memory of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe PID 388 wrote to memory of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe PID 388 wrote to memory of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe PID 388 wrote to memory of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe PID 388 wrote to memory of 3700 388 1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe"C:\Users\Admin\AppData\Local\Temp\1cf660313e31e12e6fb8a8facd9930760d32df76d653702f02af1385a37e4f01.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-120-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-121-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-122-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-123-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-124-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-125-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-126-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-127-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-128-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-129-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-130-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-131-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-132-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-133-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-134-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-135-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-136-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-137-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-139-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-138-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-140-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-141-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-143-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-142-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-144-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-145-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-146-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3700-151-0x00000000004221CA-mapping.dmp
-
memory/3700-152-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-153-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-154-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-155-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-156-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-158-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-159-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-161-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-162-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-163-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-164-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-165-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-166-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-167-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-168-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-169-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-170-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-171-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-172-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-173-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-174-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-175-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-176-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-177-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-178-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-179-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-180-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-181-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-182-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-183-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-185-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-186-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-187-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3700-210-0x0000000009D60000-0x000000000A366000-memory.dmpFilesize
6.0MB
-
memory/3700-212-0x000000000B4B0000-0x000000000B5BA000-memory.dmpFilesize
1.0MB
-
memory/3700-217-0x0000000009BE0000-0x0000000009BF2000-memory.dmpFilesize
72KB
-
memory/3700-222-0x000000000B630000-0x000000000B66E000-memory.dmpFilesize
248KB
-
memory/3700-224-0x000000000B670000-0x000000000B6BB000-memory.dmpFilesize
300KB
-
memory/3700-233-0x000000000C170000-0x000000000C1D6000-memory.dmpFilesize
408KB
-
memory/3700-240-0x000000000C6E0000-0x000000000CBDE000-memory.dmpFilesize
5.0MB
-
memory/3700-243-0x000000000C280000-0x000000000C312000-memory.dmpFilesize
584KB
-
memory/3700-248-0x000000000C320000-0x000000000C396000-memory.dmpFilesize
472KB
-
memory/3700-249-0x000000000C230000-0x000000000C280000-memory.dmpFilesize
320KB
-
memory/3700-500-0x000000000CBE0000-0x000000000CDA2000-memory.dmpFilesize
1.8MB
-
memory/3700-501-0x000000000D2E0000-0x000000000D80C000-memory.dmpFilesize
5.2MB