redline | f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d

Analysis

max time kernel
156s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe
Size

277KB
MD5

eaaf6526f8907fe5aaaa2f5d8274422e
SHA1

84bfbc9a8f30999f907d9f5edd636ac66e3f384b
SHA256

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d
SHA512

fad1c0898fa326a394f8d5d97096e6b1a11bed0efb8ca82a804d2bf18b58418f586c0e79e095497fc9bc7eb5e24812108142fd73015331995a9093f35209b8de
SSDEEP

3072:rLjO95jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTW2+TxO:rLS95jAIDHE98JEbCe3QwSAZTj

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe

description	pid	process	target process
PID 4776 set thread context of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3960 4776 WerFault.exe f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

2376 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 2376 vbc.exe

pid	pid_target	process	target process
3960	4776	WerFault.exe	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe

pid	process
2376	vbc.exe

description	pid	process
Token: SeDebugPrivilege	2376	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe

description	pid	process	target process
PID 4776 wrote to memory of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe
PID 4776 wrote to memory of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe
PID 4776 wrote to memory of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe
PID 4776 wrote to memory of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe
PID 4776 wrote to memory of 2376	4776	f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe
"C:\Users\Admin\AppData\Local\Temp\f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 160
2⤵
- Program crash
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4776 -ip 4776
1⤵
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-132-0x0000000000000000-mapping.dmp

Download
memory/2376-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2376-138-0x0000000005DB0000-0x00000000063C8000-memory.dmp

Filesize
6.1MB

Download
memory/2376-139-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/2376-140-0x00000000057C0000-0x00000000057D2000-memory.dmp

Filesize
72KB

Download
memory/2376-141-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/2376-142-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/2376-143-0x0000000007F10000-0x00000000084B4000-memory.dmp

Filesize
5.6MB

Download
memory/2376-144-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/2376-145-0x0000000007980000-0x0000000007B42000-memory.dmp

Filesize
1.8MB

Download
memory/2376-146-0x00000000089F0000-0x0000000008F1C000-memory.dmp

Filesize
5.2MB

Download