redline | f22497436cc7e0f76e35c44966bb4648a88870e2c9136e7f1e872eadcee5d4ec

Analysis

max time kernel
151s
max time network
174s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ba979859d722641315c12092cbc726b.exe
Size

235KB
MD5

7ba979859d722641315c12092cbc726b
SHA1

51a56513957c52d90008a159318604a43eec1334
SHA256

f22497436cc7e0f76e35c44966bb4648a88870e2c9136e7f1e872eadcee5d4ec
SHA512

d1eac236c98516eed65707e20902750ed2bbcd7e831cd4f5ba861cf1025f8f8d760bc960fdd68359280114c9c3295d91bccd58709fbb60e46d200f86841620a0
SSDEEP

6144:++lYNx2OWg5Kq+PwQoHp0DoK2KJSTfqrhmb:++lYzRAeQR2KJqfqrhmb

Score

10^/10

redline @p1 infostealer

Malware Config

Extracted

Family

redline

Botnet

@P1

193.106.191.138:32796

Attributes

auth_value
54c79ce081122137049ee07c0a2f38ab

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1564-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1564-61-0x00000000004221CA-mapping.dmp	family_redline
behavioral1/memory/1564-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1564-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

7ba979859d722641315c12092cbc726b.exe

description pid process target process

PID 2032 set thread context of 1564 2032 7ba979859d722641315c12092cbc726b.exe vbc.exe

description	pid	process	target process
PID 2032 set thread context of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

vbc.exe

pid	process
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe
1564	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 1564 vbc.exe

description	pid	process
Token: SeDebugPrivilege	1564	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7ba979859d722641315c12092cbc726b.exe

description	pid	process	target process
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe
PID 2032 wrote to memory of 1564	2032	7ba979859d722641315c12092cbc726b.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\7ba979859d722641315c12092cbc726b.exe
"C:\Users\Admin\AppData\Local\Temp\7ba979859d722641315c12092cbc726b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1564-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1564-61-0x00000000004221CA-mapping.dmp

Download
memory/1564-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1564-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1564-64-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download