Analysis

  • max time kernel
    55s
  • max time network
    181s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/01/2023, 04:31

General

  • Target

    2a822b97c6440e0778a6cad7e587fb9625dd6ce1d89ddbe457a9a12eedf2d1a0.exe

  • Size

    354KB

  • MD5

    0055e08b764c39324408e8e9ae3314ee

  • SHA1

    d9c95d1234e52c0df1f1e0421811916a555036d3

  • SHA256

    2a822b97c6440e0778a6cad7e587fb9625dd6ce1d89ddbe457a9a12eedf2d1a0

  • SHA512

    cfc4f4cec1f143cdd72aa8855d51021fcbf1b8090af730ea7d1e461829d044e0ef78e178fa16c7ce6828ac395de88fac01cb336e7337136610e4b9b8171c8f72

  • SSDEEP

    6144:9IbTupLlr7T0SDe14rx1AOo4h6Qe7iyPWhMnPaC/LF5N:Gnupq3g5CpMCzF5

Malware Config

Extracted

Family

redline

Botnet

logss

C2

194.180.48.225:80

Attributes
  • auth_value

    b71d7809b599c8f72a0833349911b233

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a822b97c6440e0778a6cad7e587fb9625dd6ce1d89ddbe457a9a12eedf2d1a0.exe
    "C:\Users\Admin\AppData\Local\Temp\2a822b97c6440e0778a6cad7e587fb9625dd6ce1d89ddbe457a9a12eedf2d1a0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 128
      2⤵
      • Program crash
      PID:4148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4832-163-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-164-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-128-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-330-0x000000000A6C0000-0x000000000A710000-memory.dmp

    Filesize

    320KB

  • memory/4832-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-165-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-143-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-144-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-156-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-162-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-121-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/4832-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-167-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-168-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-169-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-170-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-171-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-172-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-174-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-175-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-176-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-179-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-182-0x0000000009630000-0x0000000009C36000-memory.dmp

    Filesize

    6.0MB

  • memory/4832-183-0x0000000009190000-0x000000000929A000-memory.dmp

    Filesize

    1.0MB

  • memory/4832-184-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/4832-185-0x00000000090C0000-0x00000000090D2000-memory.dmp

    Filesize

    72KB

  • memory/4832-187-0x0000000009120000-0x000000000915E000-memory.dmp

    Filesize

    248KB

  • memory/4832-189-0x00000000092A0000-0x00000000092EB000-memory.dmp

    Filesize

    300KB

  • memory/4832-220-0x000000000A2A0000-0x000000000A306000-memory.dmp

    Filesize

    408KB

  • memory/4832-228-0x000000000A910000-0x000000000AE0E000-memory.dmp

    Filesize

    5.0MB

  • memory/4832-231-0x000000000A4F0000-0x000000000A582000-memory.dmp

    Filesize

    584KB

  • memory/4832-237-0x000000000AFE0000-0x000000000B1A2000-memory.dmp

    Filesize

    1.8MB

  • memory/4832-238-0x000000000B6E0000-0x000000000BC0C000-memory.dmp

    Filesize

    5.2MB

  • memory/4832-329-0x000000000A750000-0x000000000A7C6000-memory.dmp

    Filesize

    472KB

  • memory/5104-115-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-116-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-117-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-118-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

    Filesize

    1.6MB