redline | a57a23a46090a1f301b6023fef51c92783314dbd152ddbe02a487de001ff0fef

Analysis

max time kernel
78s
max time network
80s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
28-07-2022 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

1.4MB
MD5

78f68a0fb5f0c24f041645df00699aec
SHA1

1a17d9a718205e6ea91e24968f992c1247f2e4e8
SHA256

a57a23a46090a1f301b6023fef51c92783314dbd152ddbe02a487de001ff0fef
SHA512

2bddb8e8278d45f37f3bb3ed1877c5eef3b04828503abca2993ad0a4cb83b49143bb73351e0c65174fbebede9172317dea9ddac3b21643c17370f5dc94826d23

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
8a4b9f14d6658418ac4f4ee97fa35533

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/164216-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/164216-61-0x000000000041B53E-mapping.dmp	family_redline
behavioral1/memory/164216-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/164216-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/164632-86-0x0000000000E10000-0x0000000001BE9000-memory.dmp	family_ytstealer

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

MainModule.exestart.execrypted.exe

pid process

164536 MainModule.exe
164632 start.exe
164712 crypted.exe

pid	process
164536	MainModule.exe
164632	start.exe
164712	crypted.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\start.exe	upx
\Users\Admin\AppData\Local\Temp\start.exe	upx
C:\Users\Admin\AppData\Local\Temp\start.exe	upx
behavioral1/memory/164632-78-0x0000000000E10000-0x0000000001BE9000-memory.dmp	upx
behavioral1/memory/164632-86-0x0000000000E10000-0x0000000001BE9000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\start.exe	upx

Loads dropped DLL 5 IoCs

Processes:

AppLaunch.exe

pid process

164216 AppLaunch.exe
164216 AppLaunch.exe
164216 AppLaunch.exe
164216 AppLaunch.exe
164216 AppLaunch.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Loader.exe

description pid process target process

PID 1700 set thread context of 164216 1700 Loader.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AppLaunch.exeMainModule.exestart.exe

pid process

164216 AppLaunch.exe
164536 MainModule.exe
164632 start.exe
164632 start.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AppLaunch.exeMainModule.exe

description pid process

Token: SeDebugPrivilege 164216 AppLaunch.exe
Token: SeDebugPrivilege 164536 MainModule.exe

pid	process
164216	AppLaunch.exe
164216	AppLaunch.exe
164216	AppLaunch.exe
164216	AppLaunch.exe
164216	AppLaunch.exe

description	pid	process	target process
PID 1700 set thread context of 164216	1700	Loader.exe	AppLaunch.exe

pid	process
164216	AppLaunch.exe
164536	MainModule.exe
164632	start.exe
164632	start.exe

description	pid	process
Token: SeDebugPrivilege	164216	AppLaunch.exe
Token: SeDebugPrivilege	164536	MainModule.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

Loader.exeAppLaunch.exestart.execmd.exe

description	pid	process	target process
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 1700 wrote to memory of 164216	1700	Loader.exe	AppLaunch.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164536	164216	AppLaunch.exe	MainModule.exe
PID 164216 wrote to memory of 164632	164216	AppLaunch.exe	start.exe
PID 164216 wrote to memory of 164632	164216	AppLaunch.exe	start.exe
PID 164216 wrote to memory of 164632	164216	AppLaunch.exe	start.exe
PID 164216 wrote to memory of 164632	164216	AppLaunch.exe	start.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164216 wrote to memory of 164712	164216	AppLaunch.exe	crypted.exe
PID 164632 wrote to memory of 164844	164632	start.exe	cmd.exe
PID 164632 wrote to memory of 164844	164632	start.exe	cmd.exe
PID 164632 wrote to memory of 164844	164632	start.exe	cmd.exe
PID 164844 wrote to memory of 164236	164844	cmd.exe	choice.exe
PID 164844 wrote to memory of 164236	164844	cmd.exe	choice.exe
PID 164844 wrote to memory of 164236	164844	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:164216
- - C:\Users\Admin\AppData\Local\Temp\MainModule.exe
    "C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:164536
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:164632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\start.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:164844
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:164236
- - C:\Users\Admin\AppData\Local\Temp\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted.exe"
    3⤵
    - Executes dropped EXE
    PID:164712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
memory/164216-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/164216-64-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/164216-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/164216-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/164216-61-0x000000000041B53E-mapping.dmp

Download
memory/164216-76-0x0000000007AF0000-0x00000000088C9000-memory.dmp

Filesize
13.8MB

Download
memory/164216-77-0x0000000007AF0000-0x00000000088C9000-memory.dmp

Filesize
13.8MB

Download
memory/164216-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/164236-85-0x0000000000000000-mapping.dmp

Download
memory/164536-66-0x0000000000000000-mapping.dmp

Download
memory/164536-71-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/164536-70-0x0000000000C00000-0x0000000000C18000-memory.dmp

Filesize
96KB

Download
memory/164632-78-0x0000000000E10000-0x0000000001BE9000-memory.dmp

Filesize
13.8MB

Download
memory/164632-74-0x0000000000000000-mapping.dmp

Download
memory/164632-86-0x0000000000E10000-0x0000000001BE9000-memory.dmp

Filesize
13.8MB

Download
memory/164712-81-0x0000000000000000-mapping.dmp

Download
memory/164712-88-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/164712-89-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/164712-90-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/164844-84-0x0000000000000000-mapping.dmp

Download