Analysis
-
max time kernel
278s -
max time network
378s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 04:34
Static task
static1
Behavioral task
behavioral1
Sample
5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe
Resource
win10v2004-20221111-en
General
-
Target
5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe
-
Size
277KB
-
MD5
306fc913cab5bd2e92ce5e7d042dfbb1
-
SHA1
22b45e1ae21ea280cb2090b76fd18c23ef1656cf
-
SHA256
5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc
-
SHA512
eda3f4e5325b445953dea7749dd9221532dfa6a0c13d51e059ab2f3d4fc34edc2ec677de9e7f3a8d9bbb1b1acb4f2c9ca80464c983a77b6f4049815a3fdbd003
-
SSDEEP
3072:nLjOVXj0I/hH3RvM+4UU5i7SVx/n8p+izFgTWn+AxO:nLSVXj0I/4nFzP8p+1
Malware Config
Extracted
redline
@2023
79.137.192.28:20723
-
auth_value
93b4b7d0dc8e9415e261a402587c6710
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exedescription pid process target process PID 1316 set thread context of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exedescription pid process target process PID 1316 wrote to memory of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe PID 1316 wrote to memory of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe PID 1316 wrote to memory of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe PID 1316 wrote to memory of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe PID 1316 wrote to memory of 2392 1316 5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe"C:\Users\Admin\AppData\Local\Temp\5fba97d3754463903fd78f3eec2876cda867391c84b97da5bec5e9a07c012ddc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1316 -ip 13161⤵