redline | eefc3d0a6af3df17b4c97f8404509550aa8eb99b3757a0ba4590c6bce88c96ca

General

Target

IlusionChecker.7z
Size

3.6MB
MD5

ffdcbdd06ed59b0c4a507cac8d575913
SHA1

de5e9d4384db0866f083db001217373b34451ea6
SHA256

eefc3d0a6af3df17b4c97f8404509550aa8eb99b3757a0ba4590c6bce88c96ca
SHA512

09765eac9a6f6dd493a6907e20f07e756ae443bdb7a2e10233161e179fc46669fa5796b91df57a3e5cf3607d1f9fb4ab33e002e2b596699115b624f09b3dc5b5

Score

10^/10

redline evasion infostealer themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

IlusionChecker.exe

pid process

1480 IlusionChecker.exe

pid	process
1480	IlusionChecker.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IlusionChecker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IlusionChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IlusionChecker.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IlusionChecker\IlusionChecker.exe	themida
behavioral3/memory/1480-66-0x00000000012F0000-0x00000000012F1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

IlusionChecker.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IlusionChecker.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

IlusionChecker.exe

pid process

1480 IlusionChecker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IlusionChecker.exe

pid	process
1480	IlusionChecker.exe

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.7z	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

AUDIODG.EXE7zG.exeIlusionChecker.exe

description	pid	process
Token: 33	1884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1884	AUDIODG.EXE
Token: 33	1884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1884	AUDIODG.EXE
Token: SeRestorePrivilege	1724	7zG.exe
Token: 35	1724	7zG.exe
Token: SeSecurityPrivilege	1724	7zG.exe
Token: SeSecurityPrivilege	1724	7zG.exe
Token: SeDebugPrivilege	1480	IlusionChecker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

1724 7zG.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1808 AcroRd32.exe
1808 AcroRd32.exe
1808 AcroRd32.exe

pid	process
1724	7zG.exe

pid	process
1808	AcroRd32.exe
1808	AcroRd32.exe
1808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 548 wrote to memory of 1896	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1896	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1896	548	cmd.exe	rundll32.exe
PID 1896 wrote to memory of 1808	1896	rundll32.exe	AcroRd32.exe
PID 1896 wrote to memory of 1808	1896	rundll32.exe	AcroRd32.exe
PID 1896 wrote to memory of 1808	1896	rundll32.exe	AcroRd32.exe
PID 1896 wrote to memory of 1808	1896	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IlusionChecker.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IlusionChecker.7z
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IlusionChecker.7z"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x570
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\IlusionChecker\" -spe -an -ai#7zMap4461:106:7zEvent27377
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724

C:\Users\Admin\AppData\Local\Temp\IlusionChecker\IlusionChecker.exe
"C:\Users\Admin\AppData\Local\Temp\IlusionChecker\IlusionChecker.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IlusionChecker\IlusionChecker.exe
MD5
75b074c809301513411b15669c3d2e35

SHA1
c19e02192b3c57844dff28fdb81830d5dd5e6eaf

SHA256
1369ca0bcd6a39f6fbe3b931d61b9b752704b5c43beede8a73a7ce7e0f8d43c6

SHA512
5bc40b27062b2f774e26b8fa2b7f58f9aa4d705ce583afbcac0761b40e25a7e555246f4bdf7ade8c6c299e404c85399b235a537d93624042d2a1f331b17a1a10

Download Submit
memory/548-55-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Filesize
8KB

Download
memory/1480-66-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/1480-68-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/1808-58-0x0000000000000000-mapping.dmp

Download
memory/1808-59-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1896-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads