Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11-03-2023 10:51
Static task
static1
Behavioral task
behavioral1
Sample
446215913dd436aae1317ad90bf75677.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
446215913dd436aae1317ad90bf75677.exe
Resource
win10v2004-20230220-en
General
-
Target
446215913dd436aae1317ad90bf75677.exe
-
Size
4.2MB
-
MD5
446215913dd436aae1317ad90bf75677
-
SHA1
6f9c887f3fe17b16045fd2fa2d754c744447a4d2
-
SHA256
4bbf8447f25f44cabc87e9e20bf6594475f999a58e86c76bbad265d1db9bd513
-
SHA512
dd1b3f89efb92245640289b43ceedbf3bb562578286966d3a72bd03ff145f36054788353d39804489174c6f9018624820f54cad560394be7cf09f5127188acb3
-
SSDEEP
98304:scyyd+oHduCY3f3rFQtAjgyzZdGxHeqWF0KfgOjCH:sAswQFQtLUGFeqlm
Malware Config
Extracted
bitrat
1.38
185.246.220.122:1488
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Extracted
redline
185.246.220.122:7164
-
auth_value
bc36aaf1c6447fa611401422deaa29dd
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 1 IoCs
Processes:
rr.exepid process 524 rr.exe -
Loads dropped DLL 1 IoCs
Processes:
446215913dd436aae1317ad90bf75677.exepid process 1388 446215913dd436aae1317ad90bf75677.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
vbc.exepid process 1232 vbc.exe 1232 vbc.exe 1232 vbc.exe 1232 vbc.exe 1232 vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
446215913dd436aae1317ad90bf75677.exerr.exedescription pid process target process PID 1388 set thread context of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 524 set thread context of 996 524 rr.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 996 vbc.exe 996 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1232 vbc.exe Token: SeShutdownPrivilege 1232 vbc.exe Token: SeDebugPrivilege 996 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 1232 vbc.exe 1232 vbc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
446215913dd436aae1317ad90bf75677.exerr.exedescription pid process target process PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 1232 1388 446215913dd436aae1317ad90bf75677.exe vbc.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 1388 wrote to memory of 524 1388 446215913dd436aae1317ad90bf75677.exe rr.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe PID 524 wrote to memory of 996 524 rr.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\446215913dd436aae1317ad90bf75677.exe"C:\Users\Admin\AppData\Local\Temp\446215913dd436aae1317ad90bf75677.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\rr.exe"C:\Users\Admin\AppData\Local\Temp\rr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rr.exeFilesize
328KB
MD53f2f9975e1964be99f7e51ddc30f8c07
SHA11e6d873c70d4ac66daf350087a50409050eeeaff
SHA256843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f
SHA51289848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d
-
C:\Users\Admin\AppData\Local\Temp\rr.exeFilesize
328KB
MD53f2f9975e1964be99f7e51ddc30f8c07
SHA11e6d873c70d4ac66daf350087a50409050eeeaff
SHA256843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f
SHA51289848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d
-
\Users\Admin\AppData\Local\Temp\rr.exeFilesize
328KB
MD53f2f9975e1964be99f7e51ddc30f8c07
SHA11e6d873c70d4ac66daf350087a50409050eeeaff
SHA256843dc782676a45c6e1ab1197fe4d16ba3bc57943423eca12ec2b69ece68ac32f
SHA51289848eb83bced651355f5d8f5fe767fe7830ebe4287be4345223438318246089710e5393a4a75b7cf5c5eb2df22429ebd56f248b46e628c44ea8f5df88c5fb0d
-
memory/524-77-0x0000000000560000-0x0000000000590000-memory.dmpFilesize
192KB
-
memory/524-111-0x0000000000D50000-0x0000000000D90000-memory.dmpFilesize
256KB
-
memory/524-88-0x0000000000D50000-0x0000000000D90000-memory.dmpFilesize
256KB
-
memory/524-76-0x00000000011D0000-0x0000000001226000-memory.dmpFilesize
344KB
-
memory/996-83-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-80-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-79-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-78-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-81-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-85-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-87-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/996-89-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/1232-67-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-99-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-136-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-65-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-64-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1232-63-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-62-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-58-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-57-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-132-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-91-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-93-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-95-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-96-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-97-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-98-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-100-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-101-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/1232-102-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/1232-103-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-105-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-106-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-130-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-108-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-126-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-112-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/1232-113-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/1232-114-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-118-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-120-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1232-124-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1388-55-0x0000000004FB0000-0x0000000004FF0000-memory.dmpFilesize
256KB
-
memory/1388-107-0x0000000004FB0000-0x0000000004FF0000-memory.dmpFilesize
256KB
-
memory/1388-56-0x00000000052D0000-0x00000000056EA000-memory.dmpFilesize
4.1MB
-
memory/1388-54-0x0000000000150000-0x0000000000586000-memory.dmpFilesize
4.2MB