Analysis
-
max time kernel
106s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe
Resource
win10v2004-20221111-en
General
-
Target
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe
-
Size
399KB
-
MD5
d18952fdf658225bf98f98d5f0b39b96
-
SHA1
152d865e5a34cfc366e7b25509aadf32f4738bfb
-
SHA256
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177
-
SHA512
6f8202c90afa63e0a7da6933df31b187d2f6fcf6fb9b7ae55e7720730739c161c9a9c9f0d0016f2c7a84633681f461ad9c2b9590b7ca241011fd6800a3c28e14
-
SSDEEP
6144:56DCxLT52vMishn5u9OC9ZjYAO42SksxyBZ04gM4DkfXin8DN:56DCxLT52vMiy7W2Dwkf9N
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
TTPs:
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exedescription pid process target process PID 3448 set thread context of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1720 3448 WerFault.exe 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 2360 vbc.exe 2360 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 2360 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exedescription pid process target process PID 3448 wrote to memory of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe PID 3448 wrote to memory of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe PID 3448 wrote to memory of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe PID 3448 wrote to memory of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe PID 3448 wrote to memory of 2360 3448 46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe"C:\Users\Admin\AppData\Local\Temp\46666096ece6d7c0d0cd3e11eb60291607362dfc6a8ed65a843c9ee0a3091177.exe"Suspicious use of SetThreadContextSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 256Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3448 -ip 3448
Network
MITRE ATT&CK Matrix
Collection
Data from Local System
1Command and Control
Credential Access
Credentials in Files
1Defense Evasion
Scripting
1Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
memory/2360-132-0x0000000000000000-mapping.dmp
-
memory/2360-133-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2360-138-0x0000000005920000-0x0000000005F38000-memory.dmpFilesize
6MB
-
memory/2360-139-0x0000000005470000-0x000000000557A000-memory.dmpFilesize
1MB
-
memory/2360-140-0x00000000053A0000-0x00000000053B2000-memory.dmpFilesize
72KB
-
memory/2360-141-0x0000000005430000-0x000000000546C000-memory.dmpFilesize
240KB
-
memory/2360-142-0x00000000064F0000-0x0000000006A94000-memory.dmpFilesize
5MB
-
memory/2360-143-0x0000000005770000-0x0000000005802000-memory.dmpFilesize
584KB
-
memory/2360-144-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/2360-145-0x0000000007ED0000-0x0000000008092000-memory.dmpFilesize
1MB
-
memory/2360-146-0x00000000085D0000-0x0000000008AFC000-memory.dmpFilesize
5MB
-
memory/2360-147-0x0000000007E20000-0x0000000007E96000-memory.dmpFilesize
472KB
-
memory/2360-148-0x00000000080A0000-0x00000000080F0000-memory.dmpFilesize
320KB