redline | 0aaacc963fd27abede6b71c1de18918d07fbbdf6b58bcdf71ca2f6dbbda80c29

Analysis

max time kernel
90s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19/05/2022, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cd728cc66d9e804ad136f48bca36795.exe
Size 1.7MB
Sample220519-v1d2dachgl
SHA256 0aaacc963fd27abede6b71c1de18918d07fbbdf6b58bcdf71ca2f6dbbda80c29
MD5 1cd728cc66d9e804ad136f48bca36795
SHA1 3a3ee858cec78af0b8e62524220b32bab0e23b71
SHA512 378b9f347d88216ca801321c084b79b620b01610870601611e337a53fb40e8a31d71a25cc0c2246fe79fd686f531462daff89fa33e79642ffaf79068c40976c3
MD5 SHA1 SHA512

Score

10^/10

redline we infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

65.108.20.76:31661

Attributes

auth_value
55ab139eefed44629c7b8956ec318de9

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/836-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
836	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86
PID 5104 wrote to memory of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86
PID 5104 wrote to memory of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86
PID 5104 wrote to memory of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86
PID 5104 wrote to memory of 836	5104	1cd728cc66d9e804ad136f48bca36795.exe	86

C:\Users\Admin\AppData\Local\Temp\1cd728cc66d9e804ad136f48bca36795.exe
"C:\Users\Admin\AppData\Local\Temp\1cd728cc66d9e804ad136f48bca36795.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-131-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/836-136-0x00000000054A0000-0x0000000005AB8000-memory.dmp

Download

memory/836-137-0x0000000004F40000-0x0000000004F52000-memory.dmp

Download

memory/836-138-0x0000000005070000-0x000000000517A000-memory.dmp

Download

memory/836-139-0x0000000004FA0000-0x0000000004FDC000-memory.dmp

Download

memory/836-140-0x0000000005310000-0x0000000005386000-memory.dmp

Download

memory/836-141-0x0000000005390000-0x0000000005422000-memory.dmp

Download

memory/836-142-0x0000000006070000-0x0000000006614000-memory.dmp

Download

memory/836-143-0x0000000005470000-0x000000000548E000-memory.dmp

Download

memory/836-144-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Download

memory/836-145-0x0000000006CF0000-0x0000000006EB2000-memory.dmp

Download

memory/836-146-0x00000000073F0000-0x000000000791C000-memory.dmp

Download