redline | d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe
Size

269KB
MD5

10bf7fdbdc5812d14ea2bb8e96b89aaf
SHA1

16436b5caa6099ce764d0f834ba0ee5e0dea3d3e
SHA256

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b
SHA512

1ac93b3e3d65363b191d829a4d8882632bd6e507ded8bd0a3227e715e6302de2c00a3cd42d40858107024f90fb19ff6ac2b8e3c5a51c3dbb2177177eeb035da6
SSDEEP

3072:6MADZu3ENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy95n45erxO:fADZu3ENSjAIDHE98JEbCe3QwSAZTu

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe

description	pid	process	target process
PID 1392 set thread context of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 1392 WerFault.exe d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

1688 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 1688 vbc.exe

pid	pid_target	process	target process
836	1392	WerFault.exe	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe

pid	process
1688	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1688	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe

description	pid	process	target process
PID 1392 wrote to memory of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe
PID 1392 wrote to memory of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe
PID 1392 wrote to memory of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe
PID 1392 wrote to memory of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe
PID 1392 wrote to memory of 1688	1392	d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe
"C:\Users\Admin\AppData\Local\Temp\d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 276
2⤵
- Program crash
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1392 -ip 1392
1⤵
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1688-132-0x0000000000000000-mapping.dmp

Download
memory/1688-138-0x00000000063B0000-0x00000000069C8000-memory.dmp

Filesize
6.1MB

Download
memory/1688-139-0x0000000007D40000-0x0000000007E4A000-memory.dmp

Filesize
1.0MB

Download
memory/1688-140-0x0000000007C30000-0x0000000007C42000-memory.dmp

Filesize
72KB

Download
memory/1688-141-0x0000000007C90000-0x0000000007CCC000-memory.dmp

Filesize
240KB

Download
memory/1688-142-0x0000000008D50000-0x00000000092F4000-memory.dmp

Filesize
5.6MB

Download
memory/1688-143-0x0000000008880000-0x0000000008912000-memory.dmp

Filesize
584KB

Download
memory/1688-144-0x0000000008920000-0x0000000008986000-memory.dmp

Filesize
408KB

Download
memory/1688-145-0x0000000008B60000-0x0000000008D22000-memory.dmp

Filesize
1.8MB

Download
memory/1688-146-0x0000000009830000-0x0000000009D5C000-memory.dmp

Filesize
5.2MB

Download