redline | 116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe
Size

389KB
MD5

87959ca1627e213bb517ca964fab49fd
SHA1

3c0f28d61071e2aa903a82cb3dda6b63762c8701
SHA256

116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304
SHA512

72562caf68b4d5059c9a76aa9b9f601b4b702845a917e5d22d9544f39dadd156d7b4b217756dc31288bd663d8a40d8d074bcac55ee503234cc81a2e58ff253bd
SSDEEP

6144:Am4dxganzHlvVtNMGmHfuAKMpxSAOJnafoA1BFKZToX+kBPxf39M:AtcanzHlvxMLSb+f0axlM

Score

10^/10

redline 11 infostealer

Malware Config

Extracted

Family

redline

Botnet

79.137.202.18:45218

Attributes

auth_value
107e09eee63158d2488feb03dac75204

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe

description	pid	process	target process
PID 2276 set thread context of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 2276 WerFault.exe 116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe

pid	pid_target	process	target process
2700	2276	WerFault.exe	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe

description	pid	process	target process
PID 2276 wrote to memory of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe
PID 2276 wrote to memory of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe
PID 2276 wrote to memory of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe
PID 2276 wrote to memory of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe
PID 2276 wrote to memory of 2160	2276	116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe
"C:\Users\Admin\AppData\Local\Temp\116c606c17de79c45fa45110ab305122b8c8915125ec48b950e7ddc556ea6304.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 264
2⤵
- Program crash
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2276 -ip 2276
1⤵
PID:4280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-132-0x0000000000000000-mapping.dmp

Download
memory/2160-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2160-138-0x0000000005B50000-0x0000000006168000-memory.dmp

Filesize
6.1MB

Download
memory/2160-139-0x0000000005640000-0x000000000574A000-memory.dmp

Filesize
1.0MB

Download
memory/2160-140-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/2160-141-0x0000000005590000-0x00000000055CC000-memory.dmp

Filesize
240KB

Download