Analysis
-
max time kernel
49s -
max time network
183s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 04:06
Static task
static1
Behavioral task
behavioral1
Sample
c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe
Resource
win10-20220812-en
General
-
Target
c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe
-
Size
277KB
-
MD5
75f4207637e56307389dfa82b3463690
-
SHA1
d7d51072a59f78314e90327a9f5f74004ae8b2a7
-
SHA256
c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b
-
SHA512
1a634a4c84a6dd8304b15ad7e7e5010e347c21f9e9f23529f6f4945b00727df6084b1d7917977e1f4fed51b8fd3dc10f5dfa1627c756152a5c9c86089fe82b52
-
SSDEEP
3072:QLjOjXj0I/hH3RvM+4UU5i7SVx/n8p+izFgTWx+PsxO:QLSjXj0I/4nFzP8p+H
Malware Config
Extracted
redline
@2023
79.137.192.28:20723
-
auth_value
93b4b7d0dc8e9415e261a402587c6710
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exedescription pid process target process PID 2688 set thread context of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4260 2688 WerFault.exe c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 4072 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4072 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exedescription pid process target process PID 2688 wrote to memory of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe PID 2688 wrote to memory of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe PID 2688 wrote to memory of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe PID 2688 wrote to memory of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe PID 2688 wrote to memory of 4072 2688 c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe"C:\Users\Admin\AppData\Local\Temp\c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 5002⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2688-116-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-117-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-118-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-119-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-120-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-121-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-122-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-123-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-124-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-125-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-126-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-127-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-128-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-129-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-130-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-131-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-132-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-133-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-135-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-134-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-136-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-137-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-139-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-138-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-140-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-141-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-142-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-143-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-144-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-145-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/2688-146-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-147-0x0000000000360000-0x0000000000392000-memory.dmpFilesize
200KB
-
memory/4072-152-0x000000000037B5D2-mapping.dmp
-
memory/4072-153-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-154-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-155-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-156-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-157-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-159-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-160-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-163-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-162-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-164-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-165-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-166-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-167-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-168-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-169-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-170-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-171-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-172-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-173-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-174-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-175-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-176-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-177-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-178-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-179-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-180-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-181-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-182-0x0000000077B40000-0x0000000077CCE000-memory.dmpFilesize
1.6MB
-
memory/4072-211-0x0000000009B60000-0x000000000A166000-memory.dmpFilesize
6.0MB
-
memory/4072-213-0x000000000B3C0000-0x000000000B4CA000-memory.dmpFilesize
1.0MB
-
memory/4072-221-0x000000000B2D0000-0x000000000B2E2000-memory.dmpFilesize
72KB
-
memory/4072-223-0x000000000B330000-0x000000000B36E000-memory.dmpFilesize
248KB
-
memory/4072-225-0x000000000B370000-0x000000000B3BB000-memory.dmpFilesize
300KB
-
memory/4072-233-0x000000000C400000-0x000000000C8FE000-memory.dmpFilesize
5.0MB
-
memory/4072-237-0x000000000BFB0000-0x000000000C016000-memory.dmpFilesize
408KB
-
memory/4072-244-0x000000000C0C0000-0x000000000C152000-memory.dmpFilesize
584KB
-
memory/4072-249-0x000000000CAD0000-0x000000000CC92000-memory.dmpFilesize
1.8MB
-
memory/4072-250-0x000000000D1D0000-0x000000000D6FC000-memory.dmpFilesize
5.2MB