redline | 1e47364a4a6b1e59a75a72a91a759daa67c9f4e4101c1231fb6b236026a8a743

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-en-20211208
submitted
17/02/2022, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-23511-MACHINE QUOTATION.exe
Size 806KB
Sample220217-vtsaescdc6
SHA256 1e47364a4a6b1e59a75a72a91a759daa67c9f4e4101c1231fb6b236026a8a743
MD5 a9e31a79a0d032567fbe184a958b50b0
SHA1 7b9e171d962d46101fd05b7f7c5f027af7a6dd6a
SHA512 74d793aca6fde310c558845988d9a2bb77ac378879618d48c280b9a562041e485409fa32cf51941435e9d50ae6f9f1499471da0eef380e18e4f9bb51af95e380
MD5 SHA1 SHA512

Score

10^/10

redline xl discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

2.56.56.182:3631

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/944-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/944-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/944-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/944-66-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 944	756	RFQ-23511-MACHINE QUOTATION.exe	60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
844	PING.EXE
1764	PING.EXE
992	PING.EXE
288	PING.EXE
1492	PING.EXE
1748	PING.EXE
1484	PING.EXE
1432	PING.EXE
1136	PING.EXE
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
756	RFQ-23511-MACHINE QUOTATION.exe
756	RFQ-23511-MACHINE QUOTATION.exe
756	RFQ-23511-MACHINE QUOTATION.exe
944	RFQ-23511-MACHINE QUOTATION.exe
944	RFQ-23511-MACHINE QUOTATION.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	RFQ-23511-MACHINE QUOTATION.exe
Token: SeDebugPrivilege	944	RFQ-23511-MACHINE QUOTATION.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1704	756	RFQ-23511-MACHINE QUOTATION.exe	27
PID 756 wrote to memory of 1704	756	RFQ-23511-MACHINE QUOTATION.exe	27
PID 756 wrote to memory of 1704	756	RFQ-23511-MACHINE QUOTATION.exe	27
PID 756 wrote to memory of 1704	756	RFQ-23511-MACHINE QUOTATION.exe	27
PID 1704 wrote to memory of 1432	1704	cmd.exe	29
PID 1704 wrote to memory of 1432	1704	cmd.exe	29
PID 1704 wrote to memory of 1432	1704	cmd.exe	29
PID 1704 wrote to memory of 1432	1704	cmd.exe	29
PID 756 wrote to memory of 1940	756	RFQ-23511-MACHINE QUOTATION.exe	30
PID 756 wrote to memory of 1940	756	RFQ-23511-MACHINE QUOTATION.exe	30
PID 756 wrote to memory of 1940	756	RFQ-23511-MACHINE QUOTATION.exe	30
PID 756 wrote to memory of 1940	756	RFQ-23511-MACHINE QUOTATION.exe	30
PID 1940 wrote to memory of 992	1940	cmd.exe	32
PID 1940 wrote to memory of 992	1940	cmd.exe	32
PID 1940 wrote to memory of 992	1940	cmd.exe	32
PID 1940 wrote to memory of 992	1940	cmd.exe	32
PID 756 wrote to memory of 1948	756	RFQ-23511-MACHINE QUOTATION.exe	33
PID 756 wrote to memory of 1948	756	RFQ-23511-MACHINE QUOTATION.exe	33
PID 756 wrote to memory of 1948	756	RFQ-23511-MACHINE QUOTATION.exe	33
PID 756 wrote to memory of 1948	756	RFQ-23511-MACHINE QUOTATION.exe	33
PID 1948 wrote to memory of 288	1948	cmd.exe	35
PID 1948 wrote to memory of 288	1948	cmd.exe	35
PID 1948 wrote to memory of 288	1948	cmd.exe	35
PID 1948 wrote to memory of 288	1948	cmd.exe	35
PID 756 wrote to memory of 1708	756	RFQ-23511-MACHINE QUOTATION.exe	36
PID 756 wrote to memory of 1708	756	RFQ-23511-MACHINE QUOTATION.exe	36
PID 756 wrote to memory of 1708	756	RFQ-23511-MACHINE QUOTATION.exe	36
PID 756 wrote to memory of 1708	756	RFQ-23511-MACHINE QUOTATION.exe	36
PID 1708 wrote to memory of 1136	1708	cmd.exe	38
PID 1708 wrote to memory of 1136	1708	cmd.exe	38
PID 1708 wrote to memory of 1136	1708	cmd.exe	38
PID 1708 wrote to memory of 1136	1708	cmd.exe	38
PID 756 wrote to memory of 1460	756	RFQ-23511-MACHINE QUOTATION.exe	39
PID 756 wrote to memory of 1460	756	RFQ-23511-MACHINE QUOTATION.exe	39
PID 756 wrote to memory of 1460	756	RFQ-23511-MACHINE QUOTATION.exe	39
PID 756 wrote to memory of 1460	756	RFQ-23511-MACHINE QUOTATION.exe	39
PID 1460 wrote to memory of 1492	1460	cmd.exe	41
PID 1460 wrote to memory of 1492	1460	cmd.exe	41
PID 1460 wrote to memory of 1492	1460	cmd.exe	41
PID 1460 wrote to memory of 1492	1460	cmd.exe	41
PID 756 wrote to memory of 1112	756	RFQ-23511-MACHINE QUOTATION.exe	42
PID 756 wrote to memory of 1112	756	RFQ-23511-MACHINE QUOTATION.exe	42
PID 756 wrote to memory of 1112	756	RFQ-23511-MACHINE QUOTATION.exe	42
PID 756 wrote to memory of 1112	756	RFQ-23511-MACHINE QUOTATION.exe	42
PID 1112 wrote to memory of 844	1112	cmd.exe	44
PID 1112 wrote to memory of 844	1112	cmd.exe	44
PID 1112 wrote to memory of 844	1112	cmd.exe	44
PID 1112 wrote to memory of 844	1112	cmd.exe	44
PID 756 wrote to memory of 1620	756	RFQ-23511-MACHINE QUOTATION.exe	45
PID 756 wrote to memory of 1620	756	RFQ-23511-MACHINE QUOTATION.exe	45
PID 756 wrote to memory of 1620	756	RFQ-23511-MACHINE QUOTATION.exe	45
PID 756 wrote to memory of 1620	756	RFQ-23511-MACHINE QUOTATION.exe	45
PID 1620 wrote to memory of 1628	1620	cmd.exe	47
PID 1620 wrote to memory of 1628	1620	cmd.exe	47
PID 1620 wrote to memory of 1628	1620	cmd.exe	47
PID 1620 wrote to memory of 1628	1620	cmd.exe	47
PID 756 wrote to memory of 876	756	RFQ-23511-MACHINE QUOTATION.exe	48
PID 756 wrote to memory of 876	756	RFQ-23511-MACHINE QUOTATION.exe	48
PID 756 wrote to memory of 876	756	RFQ-23511-MACHINE QUOTATION.exe	48
PID 756 wrote to memory of 876	756	RFQ-23511-MACHINE QUOTATION.exe	48
PID 876 wrote to memory of 1764	876	cmd.exe	50
PID 876 wrote to memory of 1764	876	cmd.exe	50
PID 876 wrote to memory of 1764	876	cmd.exe	50
PID 876 wrote to memory of 1764	876	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping yahoo.com
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\PING.EXE
    ping yahoo.com
    3⤵
    - Runs ping.exe
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"
  2⤵
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-55-0x00000000744CE000-0x00000000744CF000-memory.dmp

Download

memory/756-56-0x0000000000160000-0x0000000000230000-memory.dmp

Download

memory/756-57-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/756-58-0x0000000004990000-0x0000000004A32000-memory.dmp

Download

memory/756-59-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/756-60-0x00000000051A0000-0x00000000051EC000-memory.dmp

Download

memory/944-61-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-62-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-63-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-64-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-65-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-66-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/944-67-0x000000007445E000-0x000000007445F000-memory.dmp

Download

memory/944-68-0x0000000004300000-0x0000000004301000-memory.dmp

Download