redline | c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096

General

Target

1330be0f9459506cfd3d972082f3cb0e.exe
Size

1.3MB
MD5

1330be0f9459506cfd3d972082f3cb0e
SHA1

116815a43e5d9c6ae9dc998e93948e274209711a
SHA256

c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096
SHA512

0d865e09ca6ab65f617ad43d7badfbd80db79354e73178555ea2a37d9a51f40db94f7ff3c791b00da8ff84c91397a761d03b06ddac787f162b8edc23eabda1bc

Score

10^/10

redline new1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

new1

C2

185.180.220.105:11915

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-72-0x0000000000400000-0x0000000000456000-memory.dmp	family_redline
behavioral1/memory/1692-77-0x000000000041C5F2-mapping.dmp	family_redline
behavioral1/memory/1692-79-0x0000000000400000-0x0000000000456000-memory.dmp	family_redline
behavioral1/memory/1692-78-0x0000000000400000-0x0000000000456000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

foto.exe

pid process

1824 foto.exe

pid	process
1824	foto.exe

Loads dropped DLL 4 IoCs

Processes:

1330be0f9459506cfd3d972082f3cb0e.exe

pid	process
752	1330be0f9459506cfd3d972082f3cb0e.exe
752	1330be0f9459506cfd3d972082f3cb0e.exe
752	1330be0f9459506cfd3d972082f3cb0e.exe
752	1330be0f9459506cfd3d972082f3cb0e.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

foto.exe

description pid process target process

PID 1824 set thread context of 1692 1824 foto.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1692 RegSvcs.exe
1692 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1692 RegSvcs.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1036 DllHost.exe

description	pid	process	target process
PID 1824 set thread context of 1692	1824	foto.exe	RegSvcs.exe

pid	process
1692	RegSvcs.exe
1692	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1692	RegSvcs.exe

pid	process
1036	DllHost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

1330be0f9459506cfd3d972082f3cb0e.exefoto.exe

description	pid	process	target process
PID 752 wrote to memory of 1824	752	1330be0f9459506cfd3d972082f3cb0e.exe	foto.exe
PID 752 wrote to memory of 1824	752	1330be0f9459506cfd3d972082f3cb0e.exe	foto.exe
PID 752 wrote to memory of 1824	752	1330be0f9459506cfd3d972082f3cb0e.exe	foto.exe
PID 752 wrote to memory of 1824	752	1330be0f9459506cfd3d972082f3cb0e.exe	foto.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe
PID 1824 wrote to memory of 1692	1824	foto.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\1330be0f9459506cfd3d972082f3cb0e.exe
"C:\Users\Admin\AppData\Local\Temp\1330be0f9459506cfd3d972082f3cb0e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\IMG00213.jpg
MD5
99e797779c2e243187de9d98ab687481

SHA1
a44456a0f4ca3e3cc13c2744853416073ce24a0f

SHA256
d80f7f0dbdc51723329e7f720176f2972edc2ed25d58b979063269db2ac592cc

SHA512
bf33780551cd03e623d3f73c1279e569a541f4057f3eeb6ab0a3060eb4f3aa0bb4ee7d9474eb2dd0ae5349b303016daab1f82e6e9b2bac4d0c172e0e5aa49d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
memory/752-62-0x0000000000A70000-0x0000000000A72000-memory.dmp

Filesize
8KB

Download
memory/752-60-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1036-63-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/1036-70-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1692-79-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1692-72-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1692-77-0x000000000041C5F2-mapping.dmp

Download
memory/1692-78-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1692-80-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1692-82-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1824-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads