redline | d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc

Analysis

max time kernel
136s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
20-02-2021 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
Size

2.2MB
MD5

8053506734f293e5b9a7d5a74a63efb6
SHA1

afbb07b83da8f55d49a251cb55247ac112ef12e0
SHA256

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91
SHA512

f4f0e82203d11d641e251881db91392c3f50119637c5a9a62f14d3e475b17936c42ca3de24e15c8b18640c97a9073fa8cafea769e285be5fca93316b1c55dde2

Score

10^/10

redline agilenet infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral16/memory/2132-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral16/memory/2132-17-0x000000000041EFE6-mapping.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

2132 AddInProcess32.exe

pid	process
2132	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral16/memory/724-10-0x0000000006380000-0x00000000063A1000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

description	pid	process	target process
PID 724 set thread context of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

pid	process
724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
Token: SeDebugPrivilege	2132	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe

description	pid	process	target process
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe
PID 724 wrote to memory of 2132	724	4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe
"C:\Users\Admin\AppData\Local\Temp\4b69264d212fab133ea59acc6214291f5915ab027ed8b9535214d8a655b0cc91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/724-10-0x0000000006380000-0x00000000063A1000-memory.dmp

Filesize
132KB

Download
memory/724-6-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/724-7-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/724-9-0x0000000006420000-0x0000000006421000-memory.dmp

Filesize
4KB

Download
memory/724-5-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/724-11-0x0000000006530000-0x0000000006531000-memory.dmp

Filesize
4KB

Download
memory/724-12-0x00000000064C0000-0x00000000064C1000-memory.dmp

Filesize
4KB

Download
memory/724-13-0x0000000005201000-0x0000000005202000-memory.dmp

Filesize
4KB

Download
memory/724-14-0x0000000006C20000-0x0000000006C2B000-memory.dmp

Filesize
44KB

Download
memory/724-15-0x00000000091E0000-0x00000000091E1000-memory.dmp

Filesize
4KB

Download
memory/724-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/724-3-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2132-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2132-17-0x000000000041EFE6-mapping.dmp

Download
memory/2132-20-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2132-23-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2132-24-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2132-25-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/2132-26-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/2132-27-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/2132-28-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/2132-29-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/2132-30-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download