redline | 8e69124eef60e3fd34df9b53b91c526e8c4b120d0e56bf8565080362f767284f

Analysis

max time kernel
73s
max time network
122s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/05/2022, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38299ac520e112d4d31ca74b5b9a7f89.exe
Size 1.8MB
Sample220511-bq8nfsehem
SHA256 8e69124eef60e3fd34df9b53b91c526e8c4b120d0e56bf8565080362f767284f
MD5 38299ac520e112d4d31ca74b5b9a7f89
SHA1 e5817ba0b2165839370d295db866ac1a35187634
SHA512 dd36bbd824e059802b29e0585e66d406b2bd61ac6c897a6db43d099228596ddd359c0a9de8ec6392b1edac3bde004f774d82653ee2f4eaecf5f399ccab11b5f9
MD5 SHA1 SHA512

Score

10^/10

redline infostealer persistence spyware

Malware Config

Extracted

Family

redline

95.217.225.59:40037

Attributes

auth_value
d93fac74f659041e521308e32603f62c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1124-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1124-63-0x000000000041BC1E-mapping.dmp	family_redline
behavioral1/memory/1124-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1124-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2000	test.exe
592	OneDrive.exe

Loads dropped DLL 9 IoCs

pid	Process
1124	AppLaunch.exe
1988	AppLaunch.exe
592	OneDrive.exe
1996	WerFault.exe
1996	WerFault.exe
1996	WerFault.exe
1996	WerFault.exe
1996	WerFault.exe
1996	WerFault.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"	REG.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 2000 set thread context of 1988	2000	test.exe	32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	592	WerFault.exe	33

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
956	REG.exe
1652	REG.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1124	AppLaunch.exe
1988	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	AppLaunch.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1904 wrote to memory of 1124	1904	38299ac520e112d4d31ca74b5b9a7f89.exe	28
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 1124 wrote to memory of 2000	1124	AppLaunch.exe	30
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 2000 wrote to memory of 1988	2000	test.exe	32
PID 1988 wrote to memory of 592	1988	AppLaunch.exe	33
PID 1988 wrote to memory of 592	1988	AppLaunch.exe	33
PID 1988 wrote to memory of 592	1988	AppLaunch.exe	33
PID 1988 wrote to memory of 592	1988	AppLaunch.exe	33
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 956	1988	AppLaunch.exe	34
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 1988 wrote to memory of 1652	1988	AppLaunch.exe	35
PID 592 wrote to memory of 1996	592	OneDrive.exe	39
PID 592 wrote to memory of 1996	592	OneDrive.exe	39
PID 592 wrote to memory of 1996	592	OneDrive.exe	39

C:\Users\Admin\AppData\Local\Temp\38299ac520e112d4d31ca74b5b9a7f89.exe
"C:\Users\Admin\AppData\Local\Temp\38299ac520e112d4d31ca74b5b9a7f89.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:592
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 592 -s 744
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1996
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDrive /t REG_SZ /f /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:956
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v OneDrive /t REG_BINARY /f /d 020000000000000000000000
        5⤵
        Modifies registry key
        
        PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0vSSyOA4UooBm5_s

Path C:\Users\Admin\AppData\Local\Microsoft\0vSSyOA4UooBm5_s
Size 235B
SHA256 9f6a5c9cebb6a699611311b00ebf96a3b1776d4920bf35aa16f1033319ebfea9
MD5 80b26f16b826c666613cf8c9aafa924d
SHA1 01d00e7f54e17064e75143bd1eb6c2026cccff1f
SHA512 fd9f38747f71586563c8f3ebec47cbaa10f1d3b676e56588b1bb1e47fe143acf0e73a5376b10437057616cf1c4bf72d01d1be1a1faee2aa4e2a4a39b33736c78
MD5 SHA1 SHA512

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secur32.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Secur32.dll
Size 316KB
SHA256 5075a0587b1b35c0152d8c44468641d0ab1c52fd8f1814ee257eceb9ffcb89b6
MD5 fed6517a5f84eecc29edee5586d7feeb
SHA1 56df244bf73c7ec7b59c98e1f5d47b379b58a06b
SHA512 45cab4395d509b5d7dfb904e84d5a679440412f494c4970191b5882572f4d1b9c9cd28d41a49619353c405c2477153b4a7a1568fcf307709df0b81b38c405642
SSDEEP 6144:dJ44tdGSdC73ucShSi5ARPL4emfJFD+Tx:dW7EekJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\test.exe
Size 6.6MB
SHA256 71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d
MD5 9227df15a138dd7f048f001db44c6ab4
SHA1 8f3a07f9afcb8d8d1beb0134470980b8c464c8fe
SHA512 abf151151b4ae26a35eafeb9d2986f99ddb1cdf91ce8d2100fcc7f0120ac027885a12fe152d0b44a213273bec91d40eaa76195bba00c3862c9552dda38994044
SSDEEP 196608:536pbkmVdan5bUCp2WIZnn+bqa+m/upXplY1Y8DwaAbaJNPZXjzeUM8g2p+WYMVb:kZkmVdan5bUP+bqBm/upXpN8DwaAS5zx
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 175KB
SHA256 974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610
MD5 f3af73070387fb75b19286826cc3126c
SHA1 7774854137d7ada89f3b4bdf67631456a1e74853
SHA512 a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a
SSDEEP 3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secur32.dll

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\Secur32.dll
Size 316KB
SHA256 5075a0587b1b35c0152d8c44468641d0ab1c52fd8f1814ee257eceb9ffcb89b6
MD5 fed6517a5f84eecc29edee5586d7feeb
SHA1 56df244bf73c7ec7b59c98e1f5d47b379b58a06b
SHA512 45cab4395d509b5d7dfb904e84d5a679440412f494c4970191b5882572f4d1b9c9cd28d41a49619353c405c2477153b4a7a1568fcf307709df0b81b38c405642
SSDEEP 6144:dJ44tdGSdC73ucShSi5ARPL4emfJFD+Tx:dW7EekJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secur32.dll

Path \Users\Admin\AppData\Local\Microsoft\OneDrive\Secur32.dll
Size 316KB
SHA256 5075a0587b1b35c0152d8c44468641d0ab1c52fd8f1814ee257eceb9ffcb89b6
MD5 fed6517a5f84eecc29edee5586d7feeb
SHA1 56df244bf73c7ec7b59c98e1f5d47b379b58a06b
SHA512 45cab4395d509b5d7dfb904e84d5a679440412f494c4970191b5882572f4d1b9c9cd28d41a49619353c405c2477153b4a7a1568fcf307709df0b81b38c405642
SSDEEP 6144:dJ44tdGSdC73ucShSi5ARPL4emfJFD+Tx:dW7EekJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Temp\test.exe
Size 6.6MB
SHA256 71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d
MD5 9227df15a138dd7f048f001db44c6ab4
SHA1 8f3a07f9afcb8d8d1beb0134470980b8c464c8fe
SHA512 abf151151b4ae26a35eafeb9d2986f99ddb1cdf91ce8d2100fcc7f0120ac027885a12fe152d0b44a213273bec91d40eaa76195bba00c3862c9552dda38994044
SSDEEP 196608:536pbkmVdan5bUCp2WIZnn+bqa+m/upXplY1Y8DwaAbaJNPZXjzeUM8g2p+WYMVb:kZkmVdan5bUP+bqBm/upXpN8DwaAS5zx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1124-66-0x00000000757C1000-0x00000000757C3000-memory.dmp

Download

memory/1124-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1124-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1124-58-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1124-64-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1904-54-0x0000000000BB0000-0x0000000000D80000-memory.dmp

Download

memory/1904-55-0x0000000000BB0000-0x0000000000D80000-memory.dmp

Download

memory/1988-82-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1988-71-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1988-73-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1988-81-0x0000000000400000-0x00000000004CA000-memory.dmp

Download