redline | 29200e3f6bdfb998471d4fa7c04a49c95b3de5a26197246d1f37c3dcecaa969b

Analysis

max time kernel
63s
max time network
115s
platform
windows10_x64
resource
win10v20210410
submitted
25/05/2021, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85B893E662B72F5B13DCF68FB02DAB2D.exe
Size 684KB
Sample210525-c4fa29xle2
SHA256 29200e3f6bdfb998471d4fa7c04a49c95b3de5a26197246d1f37c3dcecaa969b
MD5 85b893e662b72f5b13dcf68fb02dab2d
SHA1 304bbcbd4fb0090eaa05f16abdd74edfa7cbbea9
SHA512 59dcc1434d7f7f15b2204d34e16f94e54b1cc394a9ca125ec242f076772705a4a415e422848930969a268b86a0e8d2e6059fd95569898f6aba680f60b7cfb508
MD5 SHA1 SHA512

Score

10^/10

redline vudus infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

Vudus

80.92.204.95:59766

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4040-134-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/4040-135-0x0000000000416422-mapping.dmp	family_redline

Executes dropped EXE 1 IoCs

pid	Process
2084	sdsd.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 3300	2084	sdsd.exe	77
PID 3300 set thread context of 4040	3300	RegAsm.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4040	AddInProcess32.exe
4040	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	RegAsm.exe
Token: SeDebugPrivilege	4040	AddInProcess32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2084	2232	85B893E662B72F5B13DCF68FB02DAB2D.exe	74
PID 2232 wrote to memory of 2084	2232	85B893E662B72F5B13DCF68FB02DAB2D.exe	74
PID 2232 wrote to memory of 2084	2232	85B893E662B72F5B13DCF68FB02DAB2D.exe	74
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 2084 wrote to memory of 3300	2084	sdsd.exe	77
PID 3300 wrote to memory of 4012	3300	RegAsm.exe	78
PID 3300 wrote to memory of 4012	3300	RegAsm.exe	78
PID 3300 wrote to memory of 4012	3300	RegAsm.exe	78
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79
PID 3300 wrote to memory of 4040	3300	RegAsm.exe	79

C:\Users\Admin\AppData\Local\Temp\85B893E662B72F5B13DCF68FB02DAB2D.exe
"C:\Users\Admin\AppData\Local\Temp\85B893E662B72F5B13DCF68FB02DAB2D.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Roaming\sdsd.exe
  "C:\Users\Admin\AppData\Roaming\sdsd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      4⤵
      PID:4012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-119-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2084-121-0x00000000059E0000-0x00000000059E1000-memory.dmp

Download

memory/2084-122-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/2084-123-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/2084-124-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/2084-125-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/2084-126-0x0000000005620000-0x0000000005650000-memory.dmp

Download

memory/2084-127-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3300-128-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3300-132-0x00000000029A0000-0x00000000029A9000-memory.dmp

Download

memory/3300-133-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/4040-139-0x00000000050E0000-0x00000000050E1000-memory.dmp

Download

memory/4040-138-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/4040-134-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4040-140-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/4040-141-0x00000000051B0000-0x00000000051B1000-memory.dmp

Download

memory/4040-142-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/4040-143-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/4040-146-0x0000000006A10000-0x0000000006A11000-memory.dmp

Download

memory/4040-147-0x0000000007110000-0x0000000007111000-memory.dmp

Download

memory/4040-148-0x0000000006490000-0x0000000006491000-memory.dmp

Download