redline | 9327393673ff9ae5509ec33ebe7f750d139d2b4e5faf05ea95a372be2331282e

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7eecb99874f87e79d8af53e7e43a3f3e.exe
Size 355KB
Sample221229-pfgc4sda32
SHA256 9327393673ff9ae5509ec33ebe7f750d139d2b4e5faf05ea95a372be2331282e
MD5 7eecb99874f87e79d8af53e7e43a3f3e
SHA1 371dccae26f30a3b5eae4161fce84993081b668e
SHA512 f3967b91f582e78d771994ef1f29ba9078d38ea40ae82836b5b9a1827ec38861020f3933525a469fdb686f973539ccd541c2a762a5451a3348c93cb1e5e90bf0
SSDEEP 6144:lcj+Ny5p0BGxJ1ryIF7AOXF6WlhXYdOV76OIZafjeGToPTiBsBJV:O+Ny5p0BEf7jlhXxjTouaBJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline pub1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

pub1

89.22.231.25:45245

Attributes

auth_value
9c5c8480222ae57e3bcdac11c63a526d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	1508	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	vbc.exe
2180	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80
PID 1508 wrote to memory of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80
PID 1508 wrote to memory of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80
PID 1508 wrote to memory of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80
PID 1508 wrote to memory of 2180	1508	7eecb99874f87e79d8af53e7e43a3f3e.exe	80

C:\Users\Admin\AppData\Local\Temp\7eecb99874f87e79d8af53e7e43a3f3e.exe
"C:\Users\Admin\AppData\Local\Temp\7eecb99874f87e79d8af53e7e43a3f3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 136
  2⤵
  - Program crash
  PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-133-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/2180-138-0x0000000005BC0000-0x00000000061D8000-memory.dmp

Download

memory/2180-139-0x00000000056B0000-0x00000000057BA000-memory.dmp

Download

memory/2180-140-0x00000000055D0000-0x00000000055E2000-memory.dmp

Download

memory/2180-141-0x0000000005640000-0x000000000567C000-memory.dmp

Download

memory/2180-142-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/2180-143-0x00000000064F0000-0x0000000006582000-memory.dmp

Download

memory/2180-144-0x0000000006B40000-0x00000000070E4000-memory.dmp

Download

memory/2180-145-0x0000000007D70000-0x0000000007F32000-memory.dmp

Download

memory/2180-146-0x0000000008470000-0x000000000899C000-memory.dmp

Download