redline | c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423

Analysis

max time kernel
126s
max time network
137s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe
Size

1.8MB
MD5

b1a63f0f3a4d94cf43d400af56a514f2
SHA1

263f57427ad69f8c51003725326bca532bb3cc94
SHA256

c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423
SHA512

8fc926712470e6e0b26385b689f1dba105f3585487fff3d539950c4cf84706e99e1b66a2f24a4fb230f78614a2002033122a960ffd1e6f19e0b29b4598a52c95
SSDEEP

24576:o5wDJXe9Dz+HlhTA0nygszLbIJOKidPMmLpLuLaLcL/LhL3LxLxLsJS3k:oV9Dz+H/tnMgJodkUS0

Score

10^/10

redline infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/1472-1-0x0000000000D90000-0x0000000000FAF000-memory.dmp	family_redline
behavioral1/memory/4864-2-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1472-9-0x0000000000D90000-0x0000000000FAF000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4864	vbc.exe
4864	vbc.exe
4864	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	vbc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70
PID 1472 wrote to memory of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70
PID 1472 wrote to memory of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70
PID 1472 wrote to memory of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70
PID 1472 wrote to memory of 4864	1472	c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe	70

C:\Users\Admin\AppData\Local\Temp\c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe
"C:\Users\Admin\AppData\Local\Temp\c7ebc985e82db990f9bc39e1065243a25fb8d9b693d4936e3c00a54e633e8423.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-9-0x0000000000D90000-0x0000000000FAF000-memory.dmp

Filesize
2.1MB

Download
memory/1472-1-0x0000000000D90000-0x0000000000FAF000-memory.dmp

Filesize
2.1MB

Download
memory/1472-0-0x0000000000D90000-0x0000000000FAF000-memory.dmp

Filesize
2.1MB

Download
memory/4864-17-0x000000000B9A0000-0x000000000B9B2000-memory.dmp

Filesize
72KB

Download
memory/4864-19-0x000000000BA10000-0x000000000BA4E000-memory.dmp

Filesize
248KB

Download
memory/4864-12-0x000000000BC80000-0x000000000C17E000-memory.dmp

Filesize
5.0MB

Download
memory/4864-13-0x000000000B780000-0x000000000B812000-memory.dmp

Filesize
584KB

Download
memory/4864-14-0x000000000B900000-0x000000000B910000-memory.dmp

Filesize
64KB

Download
memory/4864-15-0x000000000B8E0000-0x000000000B8EA000-memory.dmp

Filesize
40KB

Download
memory/4864-16-0x000000000C790000-0x000000000CD96000-memory.dmp

Filesize
6.0MB

Download
memory/4864-2-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4864-18-0x000000000C180000-0x000000000C28A000-memory.dmp

Filesize
1.0MB

Download
memory/4864-11-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/4864-20-0x000000000BA80000-0x000000000BACB000-memory.dmp

Filesize
300KB

Download
memory/4864-25-0x000000000C290000-0x000000000C2F6000-memory.dmp

Filesize
408KB

Download
memory/4864-32-0x000000000D660000-0x000000000D6D6000-memory.dmp

Filesize
472KB

Download
memory/4864-219-0x000000000D630000-0x000000000D64E000-memory.dmp

Filesize
120KB

Download
memory/4864-268-0x000000000D980000-0x000000000DB42000-memory.dmp

Filesize
1.8MB

Download
memory/4864-269-0x000000000E080000-0x000000000E5AC000-memory.dmp

Filesize
5.2MB

Download
memory/4864-273-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/4864-709-0x000000000B900000-0x000000000B910000-memory.dmp

Filesize
64KB

Download
memory/4864-712-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download