59bd3b30ff0e9c2d1d335cb7cd8d305fa047e79cd0873b1a02936d9d999a35ff

Analysis

max time kernel
90s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe
Size

14.0MB
MD5

a71609fea0887e5261e10f323719ed19
SHA1

405e439c837a15ca67d8ccf7a810ffb097173af4
SHA256

59bd3b30ff0e9c2d1d335cb7cd8d305fa047e79cd0873b1a02936d9d999a35ff
SHA512

2f75a1ce40e63dfdd7612501795a017bd98362f87b43ffabc142b9e3ad99f159ff97fbf3cf63e204fbd7a2c83d5e4fcb6eb06df92ed266562051fa2d22359c61
SSDEEP

12288:Csxmdj2NtdggxR2FCLDNToj5taAtw6J4lmEDHJy1XiIopXQXZnOa33w6HVtIuClJ:HdhxR2FiNToj5IAH+y2a33w6EbjvxVC

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe

description pid process target process

PID 4260 set thread context of 1924 4260 SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

1924 vbc.exe
1924 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 1924 vbc.exe

description	pid	process	target process
PID 4260 set thread context of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe

pid	process
1924	vbc.exe
1924	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1924	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe

description	pid	process	target process
PID 4260 wrote to memory of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe
PID 4260 wrote to memory of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe
PID 4260 wrote to memory of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe
PID 4260 wrote to memory of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe
PID 4260 wrote to memory of 1924	4260	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.22408.337.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-12-0x0000000007630000-0x000000000766C000-memory.dmp

Filesize
240KB

Download
memory/1924-17-0x0000000008670000-0x00000000086E6000-memory.dmp

Filesize
472KB

Download
memory/1924-13-0x0000000007970000-0x00000000079D6000-memory.dmp

Filesize
408KB

Download
memory/1924-14-0x0000000008A20000-0x0000000008FC4000-memory.dmp

Filesize
5.6MB

Download
memory/1924-8-0x0000000007B20000-0x0000000008138000-memory.dmp

Filesize
6.1MB

Download
memory/1924-9-0x0000000007590000-0x00000000075A2000-memory.dmp

Filesize
72KB

Download
memory/1924-10-0x0000000007700000-0x000000000780A000-memory.dmp

Filesize
1.0MB

Download
memory/1924-11-0x0000000007570000-0x0000000007580000-memory.dmp

Filesize
64KB

Download
memory/1924-22-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1924-20-0x0000000009C00000-0x0000000009C1E000-memory.dmp

Filesize
120KB

Download
memory/1924-7-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1924-15-0x0000000008550000-0x00000000085E2000-memory.dmp

Filesize
584KB

Download
memory/1924-16-0x0000000008500000-0x0000000008550000-memory.dmp

Filesize
320KB

Download
memory/1924-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1924-18-0x0000000009D50000-0x0000000009F12000-memory.dmp

Filesize
1.8MB

Download
memory/1924-19-0x000000000A450000-0x000000000A97C000-memory.dmp

Filesize
5.2MB

Download
memory/4260-6-0x00000000007B0000-0x000000000094D000-memory.dmp

Filesize
1.6MB

Download
memory/4260-0-0x00000000007B0000-0x000000000094D000-memory.dmp

Filesize
1.6MB

Download