redline | 3729cc0e9183d4e4e6e7c9b82311538cc4357e35f817c32791131cc62a32ae1a

Analysis

max time kernel
146s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
09/01/2021, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
671e6f422545a4273412a90df532cfba.exe
Size 241KB
Sample210109-yxrf73fdr6
SHA256 3729cc0e9183d4e4e6e7c9b82311538cc4357e35f817c32791131cc62a32ae1a
MD5 671e6f422545a4273412a90df532cfba
SHA1 f0fc814796366c45b48d998663f26b68bdf84150
SHA512 2f07e3ce8a344347697a33346fef48cadab56c4e6bb815147bec8d832acee78652926d3e2ce318fa35f3b3fd99090f36148240fb2035c4a14c1f15261e8232c2
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2340-19-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/2340-20-0x0000000000420ECE-mapping.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2240	Mfdgizpvvdk2.exe
3856	w3bnplf2.p5a.exe
3844	w3bnplf2.p5a.tmp
2340	Mfdgizpvvdk2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2340	2240	Mfdgizpvvdk2.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	671e6f422545a4273412a90df532cfba.exe
Token: SeDebugPrivilege	2240	Mfdgizpvvdk2.exe
Token: SeDebugPrivilege	2340	Mfdgizpvvdk2.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2240	984	671e6f422545a4273412a90df532cfba.exe	75
PID 984 wrote to memory of 2240	984	671e6f422545a4273412a90df532cfba.exe	75
PID 984 wrote to memory of 2240	984	671e6f422545a4273412a90df532cfba.exe	75
PID 984 wrote to memory of 3856	984	671e6f422545a4273412a90df532cfba.exe	79
PID 984 wrote to memory of 3856	984	671e6f422545a4273412a90df532cfba.exe	79
PID 984 wrote to memory of 3856	984	671e6f422545a4273412a90df532cfba.exe	79
PID 3856 wrote to memory of 3844	3856	w3bnplf2.p5a.exe	80
PID 3856 wrote to memory of 3844	3856	w3bnplf2.p5a.exe	80
PID 3856 wrote to memory of 3844	3856	w3bnplf2.p5a.exe	80
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81
PID 2240 wrote to memory of 2340	2240	Mfdgizpvvdk2.exe	81

C:\Users\Admin\AppData\Local\Temp\671e6f422545a4273412a90df532cfba.exe
"C:\Users\Admin\AppData\Local\Temp\671e6f422545a4273412a90df532cfba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Roaming\zczsadzz.2i4\Mfdgizpvvdk2.exe
  "C:\Users\Admin\AppData\Roaming\zczsadzz.2i4\Mfdgizpvvdk2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Roaming\zczsadzz.2i4\Mfdgizpvvdk2.exe
    "C:\Users\Admin\AppData\Roaming\zczsadzz.2i4\Mfdgizpvvdk2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- C:\Users\Admin\AppData\Roaming\w3bnplf2.p5a.exe
  "C:\Users\Admin\AppData\Roaming\w3bnplf2.p5a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Users\Admin\AppData\Local\Temp\is-OAB86.tmp\w3bnplf2.p5a.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-OAB86.tmp\w3bnplf2.p5a.tmp" /SL5="$30110,239637957,780800,C:\Users\Admin\AppData\Roaming\w3bnplf2.p5a.exe"
    3⤵
    - Executes dropped EXE
    PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-3-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/984-2-0x00007FF90B900000-0x00007FF90C2EC000-memory.dmp

Download

memory/2240-9-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2240-8-0x0000000073300000-0x00000000739EE000-memory.dmp

Download

memory/2240-16-0x0000000005B30000-0x0000000005B31000-memory.dmp

Download

memory/2240-17-0x00000000054D0000-0x000000000550A000-memory.dmp

Download

memory/2240-18-0x0000000005790000-0x00000000057A6000-memory.dmp

Download

memory/2340-19-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2340-23-0x0000000073300000-0x00000000739EE000-memory.dmp

Download

memory/2340-26-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/2340-27-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download

memory/2340-28-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/2340-29-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/2340-30-0x0000000005010000-0x0000000005011000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads