redline | b42ff896888eef8fb77d21409aa4ebcd906ff4446e21c4c7e658f569f92790f6

General

Target

019af41176f7e25391be0fd72c1f9172.exe
Size

875KB
MD5

019af41176f7e25391be0fd72c1f9172
SHA1

62207e793fa36961a1d2527f7d3f0f4e9b968c98
SHA256

b42ff896888eef8fb77d21409aa4ebcd906ff4446e21c4c7e658f569f92790f6
SHA512

542607967524c853bfb8923992283dd27f0e61872c4119055952f2dbf571abfc17b136f74ab951c3c0a4ed6d92bcfc56f06fd32ff4f3c51c384a9c9349a92897

Score

10^/10

redline coreentity infostealer rezer0

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1640-4-0x0000000000300000-0x0000000000302000-memory.dmp	coreentity

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1404-6-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral1/memory/1404-7-0x000000000042A5CE-mapping.dmp	family_redline
behavioral1/memory/1404-8-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral1/memory/1404-9-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1640-5-0x0000000000D70000-0x0000000000DA1000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

019af41176f7e25391be0fd72c1f9172.exe

description pid process target process

PID 1640 set thread context of 1404 1640 019af41176f7e25391be0fd72c1f9172.exe RegSvcs.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

564 taskkill.exe

description	pid	process	target process
PID 1640 set thread context of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe

pid	process
564	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

019af41176f7e25391be0fd72c1f9172.exeRegSvcs.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1640	019af41176f7e25391be0fd72c1f9172.exe
Token: SeDebugPrivilege	1404	RegSvcs.exe
Token: SeDebugPrivilege	564	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

019af41176f7e25391be0fd72c1f9172.exeRegSvcs.execmd.exe

description	pid	process	target process
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1640 wrote to memory of 1404	1640	019af41176f7e25391be0fd72c1f9172.exe	RegSvcs.exe
PID 1404 wrote to memory of 768	1404	RegSvcs.exe	cmd.exe
PID 1404 wrote to memory of 768	1404	RegSvcs.exe	cmd.exe
PID 1404 wrote to memory of 768	1404	RegSvcs.exe	cmd.exe
PID 1404 wrote to memory of 768	1404	RegSvcs.exe	cmd.exe
PID 768 wrote to memory of 564	768	cmd.exe	taskkill.exe
PID 768 wrote to memory of 564	768	cmd.exe	taskkill.exe
PID 768 wrote to memory of 564	768	cmd.exe	taskkill.exe
PID 768 wrote to memory of 564	768	cmd.exe	taskkill.exe
PID 768 wrote to memory of 1512	768	cmd.exe	choice.exe
PID 768 wrote to memory of 1512	768	cmd.exe	choice.exe
PID 768 wrote to memory of 1512	768	cmd.exe	choice.exe
PID 768 wrote to memory of 1512	768	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\019af41176f7e25391be0fd72c1f9172.exe
"C:\Users\Admin\AppData\Local\Temp\019af41176f7e25391be0fd72c1f9172.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 1404 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 1404
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-14-0x0000000000000000-mapping.dmp

Download
memory/768-13-0x0000000000000000-mapping.dmp

Download
memory/1404-10-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/1404-6-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1404-7-0x000000000042A5CE-mapping.dmp

Download
memory/1404-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1404-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1512-15-0x0000000000000000-mapping.dmp

Download
memory/1640-4-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/1640-5-0x0000000000D70000-0x0000000000DA1000-memory.dmp

Filesize
196KB

Download
memory/1640-0-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/1640-3-0x0000000000D10000-0x0000000000D47000-memory.dmp

Filesize
220KB

Download
memory/1640-1-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads