redline | 33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b

Analysis

max time kernel
49s
max time network
69s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
26-12-2022 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe
Size

417KB
MD5

747b6385a8eadd108443d47831ffc0aa
SHA1

0da4a5d4c4f2bd177ad3aac4f5a0e60ba4b706c1
SHA256

33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b
SHA512

dba63ccb93d14a0332634827466dba6415717c6591612309bd453bcc1b38c024adf35ec65685ae11ad395f42f82bcc3838da483b898c1019ee7104ecef537e50
SSDEEP

6144:04FKsohhVZM2bKjU2bPG0YDO64pdaUI5SAO4KT2murm02FyhS8PkTK:0+KsohhVZM2bcbPhdaUI5SgrmcPB

Score

10^/10

redline bunde2 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

bunde2

65.21.5.58:24911

Attributes

auth_value
fac6d788afc7ea9267b85bc08b54c40d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	2204	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	vbc.exe
3036	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67
PID 2204 wrote to memory of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67
PID 2204 wrote to memory of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67
PID 2204 wrote to memory of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67
PID 2204 wrote to memory of 3036	2204	33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe	67

C:\Users\Admin\AppData\Local\Temp\33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe
"C:\Users\Admin\AppData\Local\Temp\33ffecf30b60d3b70498b0990c288a2333a55a1477375115581d226bc6a6d80b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 248
  2⤵
  - Program crash
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-120-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-121-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-122-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-123-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-124-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-125-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-126-0x00000000003C0000-0x00000000003F2000-memory.dmp

Filesize
200KB

Download
memory/3036-133-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-132-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-136-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-138-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-139-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-142-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-144-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-145-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-147-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-146-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-143-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-141-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-135-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-134-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-131-0x00000000003DB586-mapping.dmp

Download
memory/3036-148-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-149-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-151-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-150-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-154-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-156-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-158-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-157-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-159-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-155-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-153-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-152-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-160-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-161-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-162-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-163-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-165-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-166-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-167-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-168-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-169-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-170-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-171-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-172-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-174-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-173-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-175-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-176-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-177-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-178-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-179-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-180-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-181-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-183-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-182-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-184-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-185-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-186-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-187-0x00000000093B0000-0x00000000099B6000-memory.dmp

Filesize
6.0MB

Download
memory/3036-188-0x0000000008ED0000-0x0000000008FDA000-memory.dmp

Filesize
1.0MB

Download
memory/3036-189-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3036-190-0x0000000008E00000-0x0000000008E12000-memory.dmp

Filesize
72KB

Download
memory/3036-192-0x0000000008E60000-0x0000000008E9E000-memory.dmp

Filesize
248KB

Download
memory/3036-194-0x0000000008FE0000-0x000000000902B000-memory.dmp

Filesize
300KB

Download
memory/3036-203-0x00000000091D0000-0x0000000009236000-memory.dmp

Filesize
408KB

Download
memory/3036-211-0x0000000009D60000-0x0000000009DF2000-memory.dmp

Filesize
584KB

Download
memory/3036-212-0x000000000A300000-0x000000000A7FE000-memory.dmp

Filesize
5.0MB

Download
memory/3036-458-0x0000000009FD0000-0x000000000A046000-memory.dmp

Filesize
472KB

Download
memory/3036-459-0x0000000009F00000-0x0000000009F50000-memory.dmp

Filesize
320KB

Download
memory/3036-468-0x000000000A9D0000-0x000000000AB92000-memory.dmp

Filesize
1.8MB

Download
memory/3036-469-0x000000000B0D0000-0x000000000B5FC000-memory.dmp

Filesize
5.2MB

Download