Analysis
-
max time kernel
86s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2022 18:27
Static task
static1
Behavioral task
behavioral1
Sample
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe
Resource
win10v2004-20220812-en
General
-
Target
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe
-
Size
399KB
-
MD5
d93d1f0fdc7de7942f38b354bb098088
-
SHA1
51ee7137f7b9b7b76e2d70670cf1b334578d622f
-
SHA256
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2
-
SHA512
012e84599ea87a3eb0356f0748d2599f5046023e16c061d9b3c248b8c03dfbd60b9ad6b4014da10123f38ce2c2c60e470a42847c59f1fb7d10b212322896f8cb
-
SSDEEP
6144:8nTC5+E5GP8MSR4X3+trN99jUAOaz8n8o/tXDN:8nTC5+E5GP8Mj3Bwon8OTN
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exedescription pid process target process PID 1036 set thread context of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4052 1036 WerFault.exe 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 4648 vbc.exe 4648 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4648 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exedescription pid process target process PID 1036 wrote to memory of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe PID 1036 wrote to memory of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe PID 1036 wrote to memory of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe PID 1036 wrote to memory of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe PID 1036 wrote to memory of 4648 1036 0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe"C:\Users\Admin\AppData\Local\Temp\0c5c3d6dc72a81c0a4e7e26b126761fbaecbcf609f92f9c98936e04a29b5a5a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 2562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1036 -ip 10361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4648-132-0x0000000000000000-mapping.dmp
-
memory/4648-133-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4648-138-0x0000000005B40000-0x0000000006158000-memory.dmpFilesize
6.1MB
-
memory/4648-139-0x0000000005650000-0x000000000575A000-memory.dmpFilesize
1.0MB
-
memory/4648-140-0x0000000005590000-0x00000000055A2000-memory.dmpFilesize
72KB
-
memory/4648-141-0x00000000055F0000-0x000000000562C000-memory.dmpFilesize
240KB
-
memory/4648-142-0x0000000006710000-0x0000000006CB4000-memory.dmpFilesize
5.6MB
-
memory/4648-143-0x0000000005A50000-0x0000000005AE2000-memory.dmpFilesize
584KB
-
memory/4648-144-0x0000000006160000-0x00000000061C6000-memory.dmpFilesize
408KB
-
memory/4648-145-0x0000000006E90000-0x0000000007052000-memory.dmpFilesize
1.8MB
-
memory/4648-146-0x0000000007590000-0x0000000007ABC000-memory.dmpFilesize
5.2MB
-
memory/4648-147-0x0000000006DD0000-0x0000000006E46000-memory.dmpFilesize
472KB
-
memory/4648-148-0x0000000007060000-0x00000000070B0000-memory.dmpFilesize
320KB