redline | 0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1

Analysis

max time kernel
138s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe
Size

1.3MB
MD5

ee88a284fb166e55f13a75ea3096d22c
SHA1

8d1ca81068a1286f89ce4bc23a4ce3d3e5bf64e4
SHA256

0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1
SHA512

aadde4249c9ee5db44abc503dcc58e06ab305951b2ee37c432f1013cfed67e8734eb7dc833cf920784f79a7e599125ee8a10ba95cbe769779bea562799080dc7
SSDEEP

24576:qg9yLp0HmYObBpsiWo/8M8zmssIpcbiLq96:FJHmYOb0gPWg

Score

10^/10

redline legendaryinstalls_20230918 infostealer

Malware Config

Extracted

Family

redline

Botnet

LegendaryInstalls_20230918

62.72.23.19:80

Attributes

auth_value
7e2e28855818d91285389c56372566f4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28
PID 3024 wrote to memory of 3036	3024	0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe	28

C:\Users\Admin\AppData\Local\Temp\0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe
"C:\Users\Admin\AppData\Local\Temp\0fc6f52cae946a367dca16728eab871b1610fc044c2bc3d5ab640a71e49e50a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-11-0x0000000000AA0000-0x0000000000C48000-memory.dmp

Filesize
1.7MB

Download
memory/3024-1-0x0000000000AA0000-0x0000000000C48000-memory.dmp

Filesize
1.7MB

Download
memory/3024-0-0x0000000000AA0000-0x0000000000C48000-memory.dmp

Filesize
1.7MB

Download
memory/3036-12-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-4-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-10-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-13-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/3036-14-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/3036-15-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/3036-16-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/3036-17-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download