Overview
overview
10Static
static
infected/F...98.exe
windows7-x64
8infected/F...98.exe
windows10-2004-x64
8infected/I...er.exe
windows7-x64
10infected/I...er.exe
windows10-2004-x64
10infected/R...ed.exe
windows7-x64
10infected/R...ed.exe
windows10-2004-x64
10infected/S...64.exe
windows7-x64
10infected/S...64.exe
windows10-2004-x64
10infected/b...kO.exe
windows7-x64
10infected/b...kO.exe
windows10-2004-x64
10Analysis
-
max time kernel
159s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 17:11
Static task
static1
Behavioral task
behavioral1
Sample
infected/Furk Ultra_10298.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
infected/Furk Ultra_10298.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
infected/Installer.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
infected/Installer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
infected/RobloxSynapceX Cracked.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
infected/RobloxSynapceX Cracked.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
infected/Setup x64.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
infected/Setup x64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
infected/best-setup_FLc4rckO.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
infected/best-setup_FLc4rckO.exe
Resource
win10v2004-20220812-en
General
-
Target
infected/RobloxSynapceX Cracked.exe
-
Size
521KB
-
MD5
0afb47c295e5bc185b8272dc5a8967b6
-
SHA1
5cedced75b7fc0a2f3457e9ff4e0c98b171b9ccb
-
SHA256
0a7431f4637b27f103a4fb6d8cca52248cb4c7a77c8dd5500ca351c45c355320
-
SHA512
03f49b5f06ebfb4ee42b1e82ad36515a34823904b9d7b3c28e99d9345b2052ea689552e8b9c39b4ca47efa5dbf60ab98cf325397e4be68c759777d7cdd7823dc
-
SSDEEP
12288:O8DF2BeDFTYaOCaDecRe6kFfo13yzbVMyVS:O8DF2wDFTYaCY6kXz1VS
Malware Config
Extracted
redline
82.115.223.46:57672
-
auth_value
422677a3af554849aa4fba45f91db2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
RobloxSynapceX Cracked.exedescription pid process target process PID 3596 set thread context of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4312 3596 WerFault.exe RobloxSynapceX Cracked.exe 992 3596 WerFault.exe RobloxSynapceX Cracked.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 3048 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3048 vbc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
RobloxSynapceX Cracked.exedescription pid process target process PID 3596 wrote to memory of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe PID 3596 wrote to memory of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe PID 3596 wrote to memory of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe PID 3596 wrote to memory of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe PID 3596 wrote to memory of 3048 3596 RobloxSynapceX Cracked.exe vbc.exe PID 3596 wrote to memory of 4312 3596 RobloxSynapceX Cracked.exe WerFault.exe PID 3596 wrote to memory of 4312 3596 RobloxSynapceX Cracked.exe WerFault.exe PID 3596 wrote to memory of 4312 3596 RobloxSynapceX Cracked.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\infected\RobloxSynapceX Cracked.exe"C:\Users\Admin\AppData\Local\Temp\infected\RobloxSynapceX Cracked.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 3082⤵
- Program crash
PID:4312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 3082⤵
- Program crash
PID:992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3596 -ip 35961⤵PID:2704
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-132-0x0000000000000000-mapping.dmp
-
memory/3048-134-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3048-140-0x0000000005B00000-0x0000000006118000-memory.dmpFilesize
6.1MB
-
memory/3048-141-0x0000000005670000-0x000000000577A000-memory.dmpFilesize
1.0MB
-
memory/3048-142-0x00000000055A0000-0x00000000055B2000-memory.dmpFilesize
72KB
-
memory/3048-143-0x0000000005600000-0x000000000563C000-memory.dmpFilesize
240KB
-
memory/3048-144-0x0000000001420000-0x0000000001486000-memory.dmpFilesize
408KB
-
memory/3048-145-0x0000000006600000-0x0000000006692000-memory.dmpFilesize
584KB
-
memory/3048-146-0x0000000006C50000-0x00000000071F4000-memory.dmpFilesize
5.6MB
-
memory/3596-133-0x0000000000790000-0x0000000000817000-memory.dmpFilesize
540KB
-
memory/4312-139-0x0000000000000000-mapping.dmp