redline | d22d7ec3a9db9edb88cd373986a8aee46fc90bcb1339b147880301351d5ee522

Analysis

max time kernel
141s
max time network
145s
platform
windows10_x64
resource
win10v20210410
submitted
07/07/2021, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
609e4a8b5f5df82b0dc47275db50f4de.exe
Size 362KB
Sample210707-h8rtgn132x
SHA256 d22d7ec3a9db9edb88cd373986a8aee46fc90bcb1339b147880301351d5ee522
MD5 609e4a8b5f5df82b0dc47275db50f4de
SHA1 91be8fa9a330fb3e842f9ab1ff2db5bc78f9eb5e
SHA512 9946cdf7b39fcb895e2cce27e2c6694369012a6f1ce53579f99878830960f0f94e84f550e0cb1ef36696a4403868ea73ddd21f6ca73c40ddf9d2b47728b25cef
MD5 SHA1 SHA512

Score

10^/10

redline testmix agilenet discovery infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

TestMIX

185.215.113.62:51929

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1140-119-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/1140-120-0x0000000000417EAA-mapping.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2912	WindowsHost.exe
1784	WindowsHost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1784-149-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/1784-152-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x000100000001ab2f-136.dat	agile_net
behavioral2/files/0x000100000001ab2f-137.dat	agile_net
behavioral2/files/0x000100000001ab2f-151.dat	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1784	WindowsHost.exe
1784	WindowsHost.exe
1784	WindowsHost.exe
1784	WindowsHost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 2912 set thread context of 1784	2912	WindowsHost.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	609e4a8b5f5df82b0dc47275db50f4de.exe
1140	609e4a8b5f5df82b0dc47275db50f4de.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	609e4a8b5f5df82b0dc47275db50f4de.exe
Token: SeShutdownPrivilege	1784	WindowsHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	WindowsHost.exe
1784	WindowsHost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 508 wrote to memory of 1140	508	609e4a8b5f5df82b0dc47275db50f4de.exe	76
PID 1140 wrote to memory of 2912	1140	609e4a8b5f5df82b0dc47275db50f4de.exe	81
PID 1140 wrote to memory of 2912	1140	609e4a8b5f5df82b0dc47275db50f4de.exe	81
PID 1140 wrote to memory of 2912	1140	609e4a8b5f5df82b0dc47275db50f4de.exe	81
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82
PID 2912 wrote to memory of 1784	2912	WindowsHost.exe	82

C:\Users\Admin\AppData\Local\Temp\609e4a8b5f5df82b0dc47275db50f4de.exe
"C:\Users\Admin\AppData\Local\Temp\609e4a8b5f5df82b0dc47275db50f4de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Users\Admin\AppData\Local\Temp\609e4a8b5f5df82b0dc47275db50f4de.exe
  C:\Users\Admin\AppData\Local\Temp\609e4a8b5f5df82b0dc47275db50f4de.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-114-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/508-116-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/508-117-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

memory/508-118-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/1140-133-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Download

memory/1140-132-0x0000000006C60000-0x0000000006C61000-memory.dmp

Download

memory/1140-127-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/1140-128-0x0000000005820000-0x0000000005821000-memory.dmp

Download

memory/1140-129-0x0000000005480000-0x0000000005A86000-memory.dmp

Download

memory/1140-130-0x0000000006A90000-0x0000000006A91000-memory.dmp

Download

memory/1140-131-0x0000000007190000-0x0000000007191000-memory.dmp

Download

memory/1140-119-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1140-125-0x0000000005510000-0x0000000005511000-memory.dmp

Download

memory/1140-134-0x0000000006FD0000-0x0000000006FD1000-memory.dmp

Download

memory/1140-126-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/1140-124-0x0000000005A90000-0x0000000005A91000-memory.dmp

Download

memory/1784-152-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/1784-149-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/2912-138-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/2912-145-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/2912-146-0x0000000009A50000-0x000000000BA4F000-memory.dmp

Download

memory/2912-147-0x0000000007860000-0x0000000007A56000-memory.dmp

Download

memory/2912-148-0x0000000008E30000-0x0000000008FE8000-memory.dmp

Download

memory/2912-144-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/2912-143-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/2912-142-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download