redline | 4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409

Analysis

max time kernel
17s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
08-07-2021 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
Size

541KB
MD5

616b97038b6328ae6e45a08077df4a7a
SHA1

11473c1f0515f06579e7704dc036bbc620c7510a
SHA256

236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6
SHA512

4730733b4be691840fa1905fc4bfeeeba7ebb06e10d24cfe78a285a3e518a2f2ba31bbc378cda68edf4311df322fd137ed1f65d4b844737e9f0df547506c04e0

Score

10^/10

redline @seno_47 infostealer

Malware Config

Extracted

Family

redline

Botnet

@Seno_47

45.81.227.32:22625

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe	family_redline

Executes dropped EXE 2 IoCs

Processes:

output.exeODJgvsYTGNTHzlbflfNSWqCs.exe

pid process

1240 output.exe
3780 ODJgvsYTGNTHzlbflfNSWqCs.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 checkip.amazonaws.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ODJgvsYTGNTHzlbflfNSWqCs.exe

description pid process

Token: SeDebugPrivilege 3780 ODJgvsYTGNTHzlbflfNSWqCs.exe

pid	process
1240	output.exe
3780	ODJgvsYTGNTHzlbflfNSWqCs.exe

flow	ioc
19	checkip.amazonaws.com

description	pid	process
Token: SeDebugPrivilege	3780	ODJgvsYTGNTHzlbflfNSWqCs.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exeoutput.exe

description	pid	process	target process
PID 3968 wrote to memory of 1240	3968	236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe	output.exe
PID 3968 wrote to memory of 1240	3968	236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe	output.exe
PID 3968 wrote to memory of 1240	3968	236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe	output.exe
PID 1240 wrote to memory of 3780	1240	output.exe	ODJgvsYTGNTHzlbflfNSWqCs.exe
PID 1240 wrote to memory of 3780	1240	output.exe	ODJgvsYTGNTHzlbflfNSWqCs.exe
PID 1240 wrote to memory of 3780	1240	output.exe	ODJgvsYTGNTHzlbflfNSWqCs.exe

C:\Users\Admin\AppData\Local\Temp\236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
"C:\Users\Admin\AppData\Local\Temp\236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Roaming\output.exe
"C:\Users\Admin\AppData\Roaming\output.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe
"C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe
MD5
f4bbbbd0c06b5b5f46386ad1db6227b0

SHA1
5a026b7ed8c49b1213a6393e938c91399ff33eb8

SHA256
3783dda749b402ddb2065d6830dc3d7d2771b4b8dc02358efe64947205b2517d

SHA512
3a7554883cf3c729a1f249eff33e3ad5de69be174971209e536d7d2c829d50bc9666391e9663db782eb445f8e8f87c81ac7b0248faff2f2e594909bbd84f5d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\ODJgvsYTGNTHzlbflfNSWqCs.exe
MD5
f4bbbbd0c06b5b5f46386ad1db6227b0

SHA1
5a026b7ed8c49b1213a6393e938c91399ff33eb8

SHA256
3783dda749b402ddb2065d6830dc3d7d2771b4b8dc02358efe64947205b2517d

SHA512
3a7554883cf3c729a1f249eff33e3ad5de69be174971209e536d7d2c829d50bc9666391e9663db782eb445f8e8f87c81ac7b0248faff2f2e594909bbd84f5d48

Download Submit
C:\Users\Admin\AppData\Roaming\output.exe
MD5
2f376ad2903620fd9f52c4d8af903777

SHA1
726ecc2dff7d3af1b4d03591761183f70c9a1242

SHA256
e60ab1c5095002e6ed227251cfc4c4124db13255af95b6b76405e44e7a750215

SHA512
75fbb18d81c022bef30887718da799ffd77c462ef324b9975bd3815b7af5b759e70858a9e0f472b9bedd0af3c90a05df02fd3f6c492fea802e12c719ad2dd0eb

Download Submit
C:\Users\Admin\AppData\Roaming\output.exe
MD5
2f376ad2903620fd9f52c4d8af903777

SHA1
726ecc2dff7d3af1b4d03591761183f70c9a1242

SHA256
e60ab1c5095002e6ed227251cfc4c4124db13255af95b6b76405e44e7a750215

SHA512
75fbb18d81c022bef30887718da799ffd77c462ef324b9975bd3815b7af5b759e70858a9e0f472b9bedd0af3c90a05df02fd3f6c492fea802e12c719ad2dd0eb

Download Submit
memory/1240-119-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1240-121-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1240-116-0x0000000000000000-mapping.dmp

Download
memory/3780-125-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3780-122-0x0000000000000000-mapping.dmp

Download
memory/3780-127-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/3780-128-0x0000000006620000-0x0000000006621000-memory.dmp

Filesize
4KB

Download
memory/3780-129-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/3780-130-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/3780-131-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/3780-132-0x0000000007D70000-0x0000000007D71000-memory.dmp

Filesize
4KB

Download
memory/3780-133-0x0000000005610000-0x0000000005B0E000-memory.dmp

Filesize
5.0MB

Download
memory/3780-134-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/3780-135-0x0000000008750000-0x0000000008751000-memory.dmp

Filesize
4KB

Download
memory/3780-136-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download