redline | 58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1

Analysis

max time kernel
101s
max time network
104s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06/12/2022, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe
Size

269KB
MD5

7eeef796f094d4f0d0a898dfcaeb59e9
SHA1

d9471c923e11e32e4af2dbf091d25aae6ecd9466
SHA256

58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1
SHA512

31b7cbfc6b087887d3cbf1ccd8738d499ca5f28ed03c90be6ace8ca244aa84a95515b666eeac0068a24ef0119400702210281fe43033830ed85be5eafbd3c3e9
SSDEEP

3072:kMADZu3ENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy98n4POLxO:ZADZu3ENSjAIDHE98JEbCe3QwSAZTp

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3516 set thread context of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	3516	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4908	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67
PID 3516 wrote to memory of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67
PID 3516 wrote to memory of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67
PID 3516 wrote to memory of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67
PID 3516 wrote to memory of 4908	3516	58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe	67

C:\Users\Admin\AppData\Local\Temp\58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe
"C:\Users\Admin\AppData\Local\Temp\58567be43d8183543f190c62c3a28be2c3d8cd85005f2ad58613a810eeaa8ab1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 264
  2⤵
  - Program crash
  PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-124-0x0000000004380000-0x00000000043B2000-memory.dmp

Filesize
200KB

Download
memory/4908-130-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-131-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-132-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-133-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-134-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-136-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-137-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-139-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-140-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-142-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-143-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-144-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-145-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-141-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-146-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-147-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-148-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-149-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-150-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-151-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-152-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-153-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-154-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-155-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-156-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-157-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-158-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-159-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-160-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-161-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-163-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-164-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-165-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-166-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-167-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-168-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-169-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-170-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-171-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-172-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-173-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-174-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-175-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-176-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-177-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-178-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-179-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-180-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-181-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-182-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-183-0x0000000077C90000-0x0000000077E1E000-memory.dmp

Filesize
1.6MB

Download
memory/4908-188-0x00000000098F0000-0x0000000009EF6000-memory.dmp

Filesize
6.0MB

Download
memory/4908-191-0x000000000B150000-0x000000000B25A000-memory.dmp

Filesize
1.0MB

Download
memory/4908-198-0x000000000B040000-0x000000000B052000-memory.dmp

Filesize
72KB

Download
memory/4908-200-0x000000000B060000-0x000000000B09E000-memory.dmp

Filesize
248KB

Download
memory/4908-202-0x000000000B0A0000-0x000000000B0EB000-memory.dmp

Filesize
300KB

Download
memory/4908-210-0x000000000BCA0000-0x000000000BD32000-memory.dmp

Filesize
584KB

Download
memory/4908-211-0x000000000C240000-0x000000000C73E000-memory.dmp

Filesize
5.0MB

Download
memory/4908-213-0x000000000BE40000-0x000000000BEA6000-memory.dmp

Filesize
408KB

Download
memory/4908-226-0x000000000C740000-0x000000000C902000-memory.dmp

Filesize
1.8MB

Download
memory/4908-227-0x000000000CE40000-0x000000000D36C000-memory.dmp

Filesize
5.2MB

Download