redline | be394c34bc2d5f532f3ddac7e2d692c60401d71858d4ae2f077af559f33ef772

Analysis

max time kernel
133s
max time network
141s
platform
windows7_x64
resource
win7v20201028
submitted
01/04/2021, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
831d4e7f62efecd2fc159074383b965b.exe
Size 2.0MB
Sample210401-7elseacx72
SHA256 be394c34bc2d5f532f3ddac7e2d692c60401d71858d4ae2f077af559f33ef772
MD5 831d4e7f62efecd2fc159074383b965b
SHA1 4856dbaebf644b83f620fff1666f8553ad47d9b5
SHA512 6e60c373cb7ace5666507dd58bf39c4c92346c070f6c4a2d62cd5966dd84bddee89034ba3ee4cce52df74fc0b0aede68d49fea29ee24f9698833905c853c88e8
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.amazonaws.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
848	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	831d4e7f62efecd2fc159074383b965b.exe
Token: SeDebugPrivilege	848	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1596 wrote to memory of 848	1596	831d4e7f62efecd2fc159074383b965b.exe	29

C:\Users\Admin\AppData\Local\Temp\831d4e7f62efecd2fc159074383b965b.exe
"C:\Users\Admin\AppData\Local\Temp\831d4e7f62efecd2fc159074383b965b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-16-0x0000000004950000-0x0000000004951000-memory.dmp

Download

memory/848-14-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/848-13-0x0000000074450000-0x0000000074B3E000-memory.dmp

Download

memory/848-11-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1596-6-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/1596-9-0x000000000A600000-0x000000000A6CC000-memory.dmp

Download

memory/1596-10-0x000000000DB60000-0x000000000DBF1000-memory.dmp

Download

memory/1596-8-0x0000000000990000-0x0000000000995000-memory.dmp

Download

memory/1596-7-0x00000000081E0000-0x00000000082A7000-memory.dmp

Download

memory/1596-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Download

memory/1596-5-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/1596-3-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download