redline | 071f6bd61aef9f209be1bfb16ef1fb14bd44804fcab511b129deeb7822948ef9

Resubmissions

28-09-2021 20:51

210928-zm5pdsdae8 10

28-09-2021 20:22

210928-y5kaqsdaa9 10

Analysis

max time kernel
6s
max time network
182s
platform
windows7_x64
resource
win7v20210408
submitted
28-09-2021 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe
Size

3.9MB
MD5

1be0d2741eaac6804e24a7586b1086b0
SHA1

cdb330156b2063c6f259cb10a787463756798f7a
SHA256

071f6bd61aef9f209be1bfb16ef1fb14bd44804fcab511b129deeb7822948ef9
SHA512

cc9352b0ace0a51cac07069adf33d98e548e6726e71bf4582dcb15c3d7b0a7806765ffc57f95511f1aeca798d7fbf44c08bc5ebe7bc13626b8b7bcd0df872f85

Score

10^/10

redline vidar 706 pab4 aspackv2 infostealer stealer

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

706

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

pab4

185.215.113.15:61506

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/976-175-0x0000000003390000-0x00000000033AC000-memory.dmp	family_redline
behavioral1/memory/976-202-0x00000000033D0000-0x00000000033EA000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/624-174-0x0000000002860000-0x00000000028FD000-memory.dmp	family_vidar
behavioral1/memory/624-189-0x0000000000400000-0x0000000002403000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00040000000130db-68.dat	aspack_v212_v242
behavioral1/files/0x00040000000130db-69.dat	aspack_v212_v242
behavioral1/files/0x00040000000130d9-70.dat	aspack_v212_v242
behavioral1/files/0x00040000000130d9-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e3-75.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e3-74.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
1664	setup_install.exe
1364	Thu0247e977c7950492a.exe
1312	Thu02483b39590da5492.exe

Loads dropped DLL 20 IoCs

pid	Process
1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe
1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe
1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1664	setup_install.exe
1964	cmd.exe
1964	cmd.exe
2040	cmd.exe
1364	Thu0247e977c7950492a.exe
1364	Thu0247e977c7950492a.exe
1788	cmd.exe
1788	cmd.exe
1712	cmd.exe
1712	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	624	WerFault.exe	30

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1308	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1100 wrote to memory of 1664	1100	071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe	25
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1172	1664	setup_install.exe	57
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 1964	1664	setup_install.exe	56
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2000	1664	setup_install.exe	55
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 2040	1664	setup_install.exe	53
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1712	1664	setup_install.exe	52
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1664 wrote to memory of 1788	1664	setup_install.exe	51
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1172 wrote to memory of 1716	1172	cmd.exe	27
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1664 wrote to memory of 1764	1664	setup_install.exe	50
PID 1964 wrote to memory of 1364	1964	cmd.exe	28

C:\Users\Admin\AppData\Local\Temp\071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe
"C:\Users\Admin\AppData\Local\Temp\071F6BD61AEF9F209BE1BFB16EF1FB14BD44804FCAB51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02f60acc90a3.exe
    3⤵
    PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02c015332704.exe
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02bfe1521bcc038.exe
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02d385ff55.exe
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02588bdad8e7.exe
    3⤵
    - Loads dropped DLL
    PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02966ca5c58f270.exe
    3⤵
    - Loads dropped DLL
    PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu02483b39590da5492.exe
    3⤵
    - Loads dropped DLL
    PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu0299d0d70a4d322.exe
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Thu0247e977c7950492a.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:1716

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu0247e977c7950492a.exe
Thu0247e977c7950492a.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364
- C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu0247e977c7950492a.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu0247e977c7950492a.exe" -a
  2⤵
  PID:1892

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02966ca5c58f270.exe
Thu02966ca5c58f270.exe
1⤵
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 968
  2⤵
  - Program crash
  PID:2504

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02c015332704.exe
Thu02c015332704.exe
1⤵
PID:792

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Del.doc
1⤵
PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V /R "^NZrkFJTgsCdMvCokxiUUxUBYmGUZCyshQzrAfUxHKQBByATJNifzJsTTnyLZOTMjkrVrmIWmMjlEaZSZNkkcPXDmmpwppcSQtfd$" Una.doc
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\PING.EXE
    ping QWOCTUPM -n 30
    3⤵
    - Runs ping.exe
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
    Riconobbe.exe.com H
    3⤵
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        6⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        9⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        10⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Riconobbe.exe.com H
        11⤵
        
        PID:2400

C:\Windows\SysWOW64\dllhost.exe
dllhost.exe
1⤵
PID:2016

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02bfe1521bcc038.exe
Thu02bfe1521bcc038.exe
1⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02d385ff55.exe
Thu02d385ff55.exe
1⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02588bdad8e7.exe
Thu02588bdad8e7.exe
1⤵
PID:976

C:\Users\Admin\AppData\Local\Temp\7zSC44FDBD1\Thu02483b39590da5492.exe
Thu02483b39590da5492.exe
1⤵
- Executes dropped EXE
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-189-0x0000000000400000-0x0000000002403000-memory.dmp

Filesize
32.0MB

Download
memory/624-174-0x0000000002860000-0x00000000028FD000-memory.dmp

Filesize
628KB

Download
memory/792-161-0x000000001B140000-0x000000001B142000-memory.dmp

Filesize
8KB

Download
memory/792-151-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/976-173-0x0000000007211000-0x0000000007212000-memory.dmp

Filesize
4KB

Download
memory/976-202-0x00000000033D0000-0x00000000033EA000-memory.dmp

Filesize
104KB

Download
memory/976-187-0x0000000007213000-0x0000000007214000-memory.dmp

Filesize
4KB

Download
memory/976-165-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/976-169-0x0000000000400000-0x0000000002CD0000-memory.dmp

Filesize
40.8MB

Download
memory/976-186-0x0000000007212000-0x0000000007213000-memory.dmp

Filesize
4KB

Download
memory/976-175-0x0000000003390000-0x00000000033AC000-memory.dmp

Filesize
112KB

Download
memory/976-209-0x0000000007214000-0x0000000007216000-memory.dmp

Filesize
8KB

Download
memory/1100-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1312-208-0x0000000003750000-0x00000000038EB000-memory.dmp

Filesize
1.6MB

Download
memory/1312-207-0x0000000002820000-0x00000000028F7000-memory.dmp

Filesize
860KB

Download
memory/1312-197-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1664-88-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1664-89-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1664-84-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1664-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1664-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1664-83-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1664-85-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1664-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1664-100-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1664-96-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1716-201-0x0000000004860000-0x0000000004861000-memory.dmp

Filesize
4KB

Download
memory/1716-179-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/1716-181-0x0000000001F60000-0x0000000002BAA000-memory.dmp

Filesize
12.3MB

Download
memory/1716-241-0x00000000063D0000-0x00000000063D1000-memory.dmp

Filesize
4KB

Download
memory/1716-233-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/1716-232-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/1716-220-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/1716-226-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1716-219-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1716-240-0x00000000063A0000-0x00000000063A1000-memory.dmp

Filesize
4KB

Download
memory/1716-227-0x0000000006110000-0x0000000006111000-memory.dmp

Filesize
4KB

Download
memory/2504-223-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads