redline | d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7v20201028
submitted
20-02-2021 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
Size

2.2MB
MD5

8053506734f293e5b9a7d5a74a63efb6
SHA1

afbb07b83da8f55d49a251cb55247ac112ef12e0
SHA256

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91
SHA512

f4f0e82203d11d641e251881db91392c3f50119637c5a9a62f14d3e475b17936c42ca3de24e15c8b18640c97a9073fa8cafea769e285be5fca93316b1c55dde2

Score

10^/10

redline agilenet infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral15/memory/1956-12-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral15/memory/1956-13-0x000000000041EFE6-mapping.dmp	family_redline
behavioral15/memory/1956-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

1956 AddInProcess32.exe
Loads dropped DLL 1 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

pid process

2028 4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

pid	process
1956	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral15/memory/2028-7-0x0000000005360000-0x0000000005381000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

description	pid	process	target process
PID 2028 set thread context of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

pid	process
2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
Token: SeDebugPrivilege	1956	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

description	pid	process	target process
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 2028 wrote to memory of 1956	2028	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
"C:\Users\Admin\AppData\Local\Temp\4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/1956-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-19-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1956-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-16-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-13-0x000000000041EFE6-mapping.dmp

Download
memory/2028-7-0x0000000005360000-0x0000000005381000-memory.dmp

Filesize
132KB

Download
memory/2028-10-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2028-9-0x0000000002330000-0x000000000233B000-memory.dmp

Filesize
44KB

Download
memory/2028-8-0x0000000004D41000-0x0000000004D42000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-5-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2028-3-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download