redline | 6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289

Analysis

max time kernel
69s
max time network
95s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06-12-2022 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe
Size

277KB
MD5

46e4403b23bd2a5e2fa78be633afd5c1
SHA1

855533a42c21e25ea8d3eab683a7d99c578d8769
SHA256

6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289
SHA512

aeeaa77f24f0aec894f29e71e17d88ed1b6c75db056914e927841d6d6f029331c4c71c4171032269fe1761e4b2f71781214a9e7efd254fd15765dc5d4abb0386
SSDEEP

3072:FLjOF5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTW5+xxO:FLSF5jAIDHE98JEbCe3QwSAZTq

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe

description	pid	process	target process
PID 4836 set thread context of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2812 4836 WerFault.exe 6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

2188 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 2188 vbc.exe

pid	pid_target	process	target process
2812	4836	WerFault.exe	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe

pid	process
2188	vbc.exe

description	pid	process
Token: SeDebugPrivilege	2188	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe

description	pid	process	target process
PID 4836 wrote to memory of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe
PID 4836 wrote to memory of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe
PID 4836 wrote to memory of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe
PID 4836 wrote to memory of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe
PID 4836 wrote to memory of 2188	4836	6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe
"C:\Users\Admin\AppData\Local\Temp\6ae6bdfc1c1c926e3a57d7c30a343985dfa2c1678873f214c7bc0a5b7d26f289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 484
2⤵
- Program crash
PID:2812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-173-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-178-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-250-0x000000000D420000-0x000000000D94C000-memory.dmp

Filesize
5.2MB

Download
memory/2188-154-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-249-0x000000000CD20000-0x000000000CEE2000-memory.dmp

Filesize
1.8MB

Download
memory/2188-155-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-244-0x000000000C3C0000-0x000000000C452000-memory.dmp

Filesize
584KB

Download
memory/2188-241-0x000000000C820000-0x000000000CD1E000-memory.dmp

Filesize
5.0MB

Download
memory/2188-234-0x000000000C2B0000-0x000000000C316000-memory.dmp

Filesize
408KB

Download
memory/2188-225-0x000000000B600000-0x000000000B64B000-memory.dmp

Filesize
300KB

Download
memory/2188-223-0x000000000B5C0000-0x000000000B5FE000-memory.dmp

Filesize
248KB

Download
memory/2188-216-0x0000000009D80000-0x0000000009D92000-memory.dmp

Filesize
72KB

Download
memory/2188-213-0x000000000B690000-0x000000000B79A000-memory.dmp

Filesize
1.0MB

Download
memory/2188-211-0x0000000009E30000-0x000000000A436000-memory.dmp

Filesize
6.0MB

Download
memory/2188-182-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-181-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-180-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-179-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-157-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-162-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-177-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-176-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-175-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-174-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-172-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-171-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-170-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-169-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-167-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-168-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-166-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-147-0x0000000004C00000-0x0000000004C32000-memory.dmp

Filesize
200KB

Download
memory/2188-152-0x0000000004C1B5B2-mapping.dmp

Download
memory/2188-153-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-165-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-164-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-163-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-156-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-159-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-160-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-134-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-117-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-121-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-119-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-146-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-145-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-144-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-143-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-142-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-141-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-140-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-116-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-139-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-138-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-137-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-136-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-135-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-133-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-132-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-131-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-130-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-129-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-128-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-127-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-126-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-125-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-124-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-123-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-122-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-120-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4836-118-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download