redline | d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe
Size

1.2MB
MD5

8e26aa0c4f94144699e890897aa7342a
SHA1

0139d4b7261eded25fff6f9357eb876ad88ac9ea
SHA256

d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701
SHA512

f2879dec7ed08b1083538428062e9d2e8ef464492b70a15dcbc8bc1a1ff8b6697aa82ce8eb0f5a2842955096c527c6f953c5bab5e530d7384641868dd13d15b1
SSDEEP

24576:kMZ/4+PJAzxy99wINGGnAia8DmCJhSOh8TMnV:kMZ/4+uy99wIEGJyEhXwQ

Score

10^/10

redline infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1744-1-0x0000000000300000-0x000000000048F000-memory.dmp	family_redline
behavioral1/memory/3004-4-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1744-11-0x0000000000300000-0x000000000048F000-memory.dmp	family_redline
behavioral1/memory/3004-10-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/3004-12-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3004	vbc.exe
3004	vbc.exe
3004	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28
PID 1744 wrote to memory of 3004	1744	d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-0-0x0000000000300000-0x000000000048F000-memory.dmp

Filesize
1.6MB

Download
memory/1744-1-0x0000000000300000-0x000000000048F000-memory.dmp

Filesize
1.6MB

Download
memory/1744-11-0x0000000000300000-0x000000000048F000-memory.dmp

Filesize
1.6MB

Download
memory/3004-2-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3004-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3004-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3004-10-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3004-12-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3004-13-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-14-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/3004-15-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-16-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download