redline | 99e526e91f6207bbf66cde726e19b74dcccf8370465fd75f2c44fb69716186a1

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04/06/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HoicoExecutor.exe
Size 291KB
Sample220604-khkfbsffc8
SHA256 99e526e91f6207bbf66cde726e19b74dcccf8370465fd75f2c44fb69716186a1
MD5 5a2c9893d687184b0c1ae2b009feb184
SHA1 030c2eef16c7e35aa6bb70a78b3aed49e68777fc
SHA512 fafa8d14ccfcc1307088d9c2ee0266b51e81b46a0cd678fcc9603af9d6e7c2bb833e0440d91552345c5e94241576a63aedcf38b4eb9c149e9a3dd393605ce13a
MD5 SHA1 SHA512

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

185.215.113.94:15995

Attributes

auth_value
b47de34bfaa118c06d8b57dbcef81ff4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/456-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2176	kermel.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 688 set thread context of 456	688	HoicoExecutor.exe	79
PID 2176 set thread context of 1568	2176	kermel.exe	93

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2380	688	WerFault.exe	77
3596	2176	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
456	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 456	688	HoicoExecutor.exe	79
PID 688 wrote to memory of 456	688	HoicoExecutor.exe	79
PID 688 wrote to memory of 456	688	HoicoExecutor.exe	79
PID 688 wrote to memory of 456	688	HoicoExecutor.exe	79
PID 688 wrote to memory of 456	688	HoicoExecutor.exe	79
PID 456 wrote to memory of 2176	456	AppLaunch.exe	91
PID 456 wrote to memory of 2176	456	AppLaunch.exe	91
PID 456 wrote to memory of 2176	456	AppLaunch.exe	91
PID 2176 wrote to memory of 1568	2176	kermel.exe	93
PID 2176 wrote to memory of 1568	2176	kermel.exe	93
PID 2176 wrote to memory of 1568	2176	kermel.exe	93
PID 2176 wrote to memory of 1568	2176	kermel.exe	93
PID 2176 wrote to memory of 1568	2176	kermel.exe	93

C:\Users\Admin\AppData\Local\Temp\HoicoExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\HoicoExecutor.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\kermel.exe
    "C:\Users\Admin\AppData\Local\Temp\kermel.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 140
      4⤵
      Program crash
      PID:3596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 296
  2⤵
  - Program crash
  PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 688 -ip 688
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2176 -ip 2176
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kermel.exe

Path C:\Users\Admin\AppData\Local\Temp\kermel.exe
Size 2.8MB
SHA256 d1349f5749c398440cfcbeb53adbe3e182cb0e8ad9464dd465f2248ad4fb44a7
MD5 ba3a1fda73c69951b77ed2384ba067f9
SHA1 e26047c9cec9f6b3ef5ea7e06448096c08f58154
SHA512 db7cb5085141f1b4656c08d4aab9505b3b26b157f5b5829a53f3e3be8e9849d896114957563092c0726041bf58d543020f994f9b6b9a0143ed1b17bb40afec1f
SSDEEP 24576:BpXUMvWArUUkV6/pUbA7AC9ztpbejI4ASmfoAq00rf/hsTibuQ5p3h3rWZ:brb9ybYACNt9yI4ASuU0y/hY
MD5 SHA1 SHA512 SSDEEP

Submit Download

kermel.exe

Path C:\Users\Admin\AppData\Local\Temp\kermel.exe
Size 2.8MB
SHA256 d1349f5749c398440cfcbeb53adbe3e182cb0e8ad9464dd465f2248ad4fb44a7
MD5 ba3a1fda73c69951b77ed2384ba067f9
SHA1 e26047c9cec9f6b3ef5ea7e06448096c08f58154
SHA512 db7cb5085141f1b4656c08d4aab9505b3b26b157f5b5829a53f3e3be8e9849d896114957563092c0726041bf58d543020f994f9b6b9a0143ed1b17bb40afec1f
SSDEEP 24576:BpXUMvWArUUkV6/pUbA7AC9ztpbejI4ASmfoAq00rf/hsTibuQ5p3h3rWZ:brb9ybYACNt9yI4ASuU0y/hY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-139-0x00000000053D0000-0x000000000540C000-memory.dmp

Download

memory/456-145-0x0000000007B60000-0x0000000007D22000-memory.dmp

Download

memory/456-138-0x0000000005470000-0x000000000557A000-memory.dmp

Download

memory/456-140-0x0000000001020000-0x0000000001096000-memory.dmp

Download

memory/456-141-0x0000000001390000-0x0000000001422000-memory.dmp

Download

memory/456-142-0x00000000065B0000-0x0000000006B54000-memory.dmp

Download

memory/456-143-0x0000000001470000-0x000000000148E000-memory.dmp

Download

memory/456-144-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/456-137-0x0000000005340000-0x0000000005352000-memory.dmp

Download

memory/456-146-0x0000000008260000-0x000000000878C000-memory.dmp

Download

memory/456-147-0x0000000006DF0000-0x0000000006E40000-memory.dmp

Download

memory/456-131-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/456-136-0x00000000058A0000-0x0000000005EB8000-memory.dmp

Download

memory/1568-152-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1568-158-0x0000000000400000-0x00000000004CA000-memory.dmp

Download