redline | 18d2e2fb3c22f506e85bf2c858bb511b032bb373f5e3b5e34cfb0749e3032e3a

General

Target

FilesSetup.exe
Size

350.8MB
MD5

9c6ef6eedc7016c5fba6ba8920255042
SHA1

a0961165ea07828f3bf86a227d85abb8d4b11818
SHA256

18d2e2fb3c22f506e85bf2c858bb511b032bb373f5e3b5e34cfb0749e3032e3a
SHA512

c2234d3d2256036c702cfba0da2327b67ee08580e67e0fe2f76ca181493adfa2a1de0f0d351dfdca90a01f142ad312aae391ef04aa353ced5e497b49979dfacd

Score

10^/10

redline dsf discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dsf

C2

185.215.113.72:61983

Attributes

auth_value
b821593a97a1337ef8c5a6c45313524a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1332-56-0x00000000008E0000-0x0000000000CC7000-memory.dmp	family_redline
behavioral1/memory/1332-58-0x00000000008E0000-0x0000000000CC7000-memory.dmp	family_redline
behavioral1/memory/1332-64-0x00000000008E0000-0x0000000000CC7000-memory.dmp	family_redline
behavioral1/memory/1332-69-0x00000000008E0000-0x0000000000CC7000-memory.dmp	family_redline
behavioral1/memory/1332-70-0x00000000008E0000-0x0000000000CC7000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

FilesSetup.exe

pid process

1332 FilesSetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1332	FilesSetup.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF00A721-9E35-11EC-AC7F-466006210864} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00fb1b54232d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353436450"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c000000000200000000001066000000010000200000007e90cf9b1a5ec703a74c5bff60b1257659f78f08b29a6afe88b107ac8f3d4d41000000000e8000000002000020000000e25a34b0dcd0d66516e6de3e3567decdf77d211de6800b1d44d9d33c8a0d6354200000002697267ed6fb41f790b9815ddd8dd9f09a4121960627aa9cb44f31b67d088a37400000009c253b13b374736999710f8f8e5e95efb2507c5069fcf785d6bd0080ef690bc3c7bb8128dc71a4ed8a61514aa226b81414c77f6a7ecc4333f7f754df3712a57b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c00000000020000000000106600000001000020000000a576c918868a8adae47a91d7b993d1e958a75d933e9ea15224d4bc9ee534b134000000000e80000000020000200000004ea2d5bd5b972bbc93116abda4d7199a0c606a21d37f66b2b803b890bd08559e90000000a5bb1d84ed3e0ec8f7bdb3628cc904c4a93676cdac30f92e64ea6ce2d370859958878e7d786181bd26263debb8bd61fb0fca8f139c7c6718194b0695dfd709a47c2f2d43dcb559669e52c4dd4eff1521e68445ea6c5cd2ea35ccdc40741ce863ab6ab0260daf34ab3c847d0cffd258d3dd11f7f5e3c63421ae163d723a0bd53deb167c49a1eb1a5712fda1a000b67c39400000007f104de08f3a717cfbec6138a4c898ccb19fb2126b386855137618369740b88211980e28be6fa8afb8bb0bc363bd74b3d533e0cffdd2657aa487f4ad545fea1f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

FilesSetup.exe

pid process

1332 FilesSetup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FilesSetup.exe

description pid process

Token: SeDebugPrivilege 1332 FilesSetup.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1760 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1760 iexplore.exe
1760 iexplore.exe
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE

pid	process
1332	FilesSetup.exe

description	pid	process
Token: SeDebugPrivilege	1332	FilesSetup.exe

pid	process
1760	iexplore.exe

pid	process
1760	iexplore.exe
1760	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

FilesSetup.exeiexplore.exe

description	pid	process	target process
PID 1332 wrote to memory of 1760	1332	FilesSetup.exe	iexplore.exe
PID 1332 wrote to memory of 1760	1332	FilesSetup.exe	iexplore.exe
PID 1332 wrote to memory of 1760	1332	FilesSetup.exe	iexplore.exe
PID 1332 wrote to memory of 1760	1332	FilesSetup.exe	iexplore.exe
PID 1760 wrote to memory of 1532	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1532	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1532	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1532	1760	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\FilesSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FilesSetup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1bjue7
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RV4L5Z3M.txt
MD5
f4aa9d74158cccecbd58d93c9c6d5976

SHA1
6e02111f20940840d282412471105b677de8550e

SHA256
c0d3aca9760d473cc006cf92099055874883a24516110204112c148a6428a6d8

SHA512
193b2e816bd70c694c7d11334f917736fa28226b7cb72fe77bfc176c57093e1eed4b424e17e49d8ce62c100f34236b1123f1159dd5e5c8e0d4d32f3e6877523b

Download Submit
memory/1332-68-0x0000000074930000-0x0000000074A8C000-memory.dmp

Filesize
1.4MB

Download
memory/1332-55-0x0000000074500000-0x000000007454A000-memory.dmp

Filesize
296KB

Download
memory/1332-64-0x00000000008E0000-0x0000000000CC7000-memory.dmp

Filesize
3.9MB

Download
memory/1332-58-0x00000000008E0000-0x0000000000CC7000-memory.dmp

Filesize
3.9MB

Download
memory/1332-60-0x00000000769F0000-0x0000000076A9C000-memory.dmp

Filesize
688KB

Download
memory/1332-61-0x0000000075360000-0x00000000753A7000-memory.dmp

Filesize
284KB

Download
memory/1332-62-0x0000000076730000-0x0000000076787000-memory.dmp

Filesize
348KB

Download
memory/1332-63-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/1332-65-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1332-69-0x00000000008E0000-0x0000000000CC7000-memory.dmp

Filesize
3.9MB

Download
memory/1332-57-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1332-56-0x00000000008E0000-0x0000000000CC7000-memory.dmp

Filesize
3.9MB

Download
memory/1332-66-0x0000000075360000-0x00000000753A7000-memory.dmp

Filesize
284KB

Download
memory/1332-70-0x00000000008E0000-0x0000000000CC7000-memory.dmp

Filesize
3.9MB

Download
memory/1332-71-0x0000000076290000-0x000000007631F000-memory.dmp

Filesize
572KB

Download
memory/1332-73-0x0000000073CD0000-0x00000000743BE000-memory.dmp

Filesize
6.9MB

Download
memory/1332-74-0x00000000753E0000-0x000000007602A000-memory.dmp

Filesize
12.3MB

Download
memory/1332-75-0x0000000073540000-0x0000000073557000-memory.dmp

Filesize
92KB

Download
memory/1332-76-0x00000000769B0000-0x00000000769E5000-memory.dmp

Filesize
212KB

Download
memory/1332-77-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/1332-78-0x000000006B590000-0x000000006B720000-memory.dmp

Filesize
1.6MB

Download
memory/1332-79-0x000000006A3F0000-0x000000006A407000-memory.dmp

Filesize
92KB

Download
memory/1332-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads