Analysis
-
max time kernel
90s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2022 07:54
Static task
static1
Behavioral task
behavioral1
Sample
376cfa74d8a65fb5836828c55cfd8fc8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
376cfa74d8a65fb5836828c55cfd8fc8.exe
Resource
win10v2004-20221111-en
General
-
Target
376cfa74d8a65fb5836828c55cfd8fc8.exe
-
Size
398KB
-
MD5
376cfa74d8a65fb5836828c55cfd8fc8
-
SHA1
351c94238b50a6b3fbfb1ad538b6b2afa87b4dfa
-
SHA256
99b7396773e11d0a1d44f674310025344f2d8c9d2813d33e9bd7dd35ac5f2360
-
SHA512
5faef6a465e5c3ae6da08c7191942feb6967557b78ca4d2d613957245dcfa6eeb08eaf573a20e04f1a61b6cf926223ecd9fae3ecb2b2e9f614647e466b774e73
-
SSDEEP
6144:Wygxer6dluLigEBBY2o1FhZRVPjGAOngeijc+/B9IVmoGP7:Wygxer6dluLigEZoNZaJOf9OQP7
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
376cfa74d8a65fb5836828c55cfd8fc8.exedescription pid process target process PID 4332 set thread context of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2100 4332 WerFault.exe 376cfa74d8a65fb5836828c55cfd8fc8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 4304 vbc.exe 4304 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4304 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
376cfa74d8a65fb5836828c55cfd8fc8.exedescription pid process target process PID 4332 wrote to memory of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe PID 4332 wrote to memory of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe PID 4332 wrote to memory of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe PID 4332 wrote to memory of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe PID 4332 wrote to memory of 4304 4332 376cfa74d8a65fb5836828c55cfd8fc8.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\376cfa74d8a65fb5836828c55cfd8fc8.exe"C:\Users\Admin\AppData\Local\Temp\376cfa74d8a65fb5836828c55cfd8fc8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 1482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4332 -ip 43321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4304-132-0x0000000000000000-mapping.dmp
-
memory/4304-133-0x0000000001100000-0x0000000001132000-memory.dmpFilesize
200KB
-
memory/4304-138-0x0000000005C40000-0x0000000006258000-memory.dmpFilesize
6.1MB
-
memory/4304-139-0x00000000057B0000-0x00000000058BA000-memory.dmpFilesize
1.0MB
-
memory/4304-140-0x00000000056F0000-0x0000000005702000-memory.dmpFilesize
72KB
-
memory/4304-141-0x0000000005750000-0x000000000578C000-memory.dmpFilesize
240KB
-
memory/4304-142-0x0000000005A80000-0x0000000005B12000-memory.dmpFilesize
584KB
-
memory/4304-143-0x0000000006810000-0x0000000006DB4000-memory.dmpFilesize
5.6MB
-
memory/4304-144-0x00000000062D0000-0x0000000006336000-memory.dmpFilesize
408KB
-
memory/4304-145-0x0000000007B00000-0x0000000007B76000-memory.dmpFilesize
472KB
-
memory/4304-146-0x0000000007B80000-0x0000000007BD0000-memory.dmpFilesize
320KB
-
memory/4304-147-0x00000000073C0000-0x0000000007582000-memory.dmpFilesize
1.8MB
-
memory/4304-148-0x0000000009100000-0x000000000962C000-memory.dmpFilesize
5.2MB