redline | fdd01894000e39d6d239cbc8b549afb38ed35c8ad3877a252bbdc8335198cbb7

Analysis

max time kernel
149s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04/06/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kiddions Modest Menu.exe
Size 291KB
Sample220604-khkfbsbecr
SHA256 fdd01894000e39d6d239cbc8b549afb38ed35c8ad3877a252bbdc8335198cbb7
MD5 2802091c1fdf1b5365a5fc6bdded72b0
SHA1 037890c2bcdeafd2650b925db7dd477c37bfbe71
SHA512 4a366ad52a54eebac8c040f5e72321e875cd0513b5661a66336265a5f8e24308e2e224524d598744d1435b5b8c69750f90827645f12d0c8e3ea5fd27e02db3aa
MD5 SHA1 SHA512

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

135.181.223.87:40037

Attributes

auth_value
46ad817ba243648efa4c7a58be162d5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3184-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 3184	2984	Kiddions Modest Menu.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	2984	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3184	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3184	2984	Kiddions Modest Menu.exe	79
PID 2984 wrote to memory of 3184	2984	Kiddions Modest Menu.exe	79
PID 2984 wrote to memory of 3184	2984	Kiddions Modest Menu.exe	79
PID 2984 wrote to memory of 3184	2984	Kiddions Modest Menu.exe	79
PID 2984 wrote to memory of 3184	2984	Kiddions Modest Menu.exe	79

C:\Users\Admin\AppData\Local\Temp\Kiddions Modest Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Kiddions Modest Menu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 312
  2⤵
  - Program crash
  PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2984 -ip 2984
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3184-131-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3184-136-0x00000000052D0000-0x00000000058E8000-memory.dmp

Download

memory/3184-137-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Download

memory/3184-138-0x0000000004E20000-0x0000000004F2A000-memory.dmp

Download

memory/3184-139-0x0000000004D50000-0x0000000004D8C000-memory.dmp

Download

memory/3184-140-0x0000000005FE0000-0x0000000006584000-memory.dmp

Download

memory/3184-141-0x0000000000CC0000-0x0000000000D52000-memory.dmp

Download

memory/3184-142-0x0000000005250000-0x00000000052C6000-memory.dmp

Download

memory/3184-143-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Download

memory/3184-144-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/3184-145-0x0000000007550000-0x0000000007712000-memory.dmp

Download

memory/3184-146-0x0000000007720000-0x0000000007C4C000-memory.dmp

Download

memory/3184-147-0x0000000006940000-0x0000000006990000-memory.dmp

Download