redline | 3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97

General

Target

379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
Size

1.2MB
MD5

379a6a4f7be0d0e21a5e5b996ea8aeeb
SHA1

27df283dcb89ee72f304df89d3938239acc32439
SHA256

3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97
SHA512

e6705fc43877d4f46052f03dbd0a17cdc5afee7b2d6eec4f944556d005a613e9b356361ad3df9cb5164925f5429109d348a4c0b90018220047f8956d9b32f4b8

Score

10^/10

redline logsdiller cloud (sup: @mr_golds)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

193.233.193.14:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/187944-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/187944-61-0x000000000041AE1E-mapping.dmp	family_redline
behavioral1/memory/187944-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/187944-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

379a6a4f7be0d0e21a5e5b996ea8aeeb.exe

description pid process target process

PID 608 set thread context of 187944 608 379a6a4f7be0d0e21a5e5b996ea8aeeb.exe AppLaunch.exe

description	pid	process	target process
PID 608 set thread context of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366629683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a4618440aad801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\ = "16"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a7846285141250000000002000000000010660000000100002000000036aa21756c33bceb887dadddfb6fa5abcfdba83c990317ae34d3fa82d1a8afae000000000e8000000002000020000000e8bc59839ba30d1ba9df7c0548773044ba363146513a5a671fb4fae79c991ccc20000000a5ab8464bc001defcb73bfbcc42849c41aa61ffe1b66fe7277d89e1f25a0f5c14000000035e5403e1d6befb2281764219d623a69dc6ebd2ad60cd564bc7eb569a7033bb1b7542e25b0761dd8a8f1a7f528d0e6d9fd830c5cba8f6daab06119648398afe0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9381931-1633-11ED-8FD8-FEC1DD9ACD16} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\Total = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a784628514125000000000200000000001066000000010000200000007421b88b1d33283c2a89bcf216ea9468f0966568f387037e3d8e94791fc88b89000000000e800000000200002000000088a7a143644b006bdf3e0ee3d8ba4dfe4616eaa398a2cb875ec12b47bbe0a30690000000ab12e220b55c3f0ab546f3f014df10fae508b7bb71f9a64bc361d36d55324454afba70e5ee7ca04049f8ad2a0615ff9cb723f53f3369087be8992583443dd745d8fc12d2b81f0779ea5d855b18cb2aea1d8ae7db7d421a843953f7aa0c7675b203e1f9e9c812728b75a29512878a2d883729fda40a0db87b55a23b55cd9cf685e126cf0179006597a64ae4e268d8174e400000006a0e957139ef115f6d95eda9f35b3f6dcf8bdc65a9385d224aace9acfb7377d6c91c39f040838db3247338239b20cfa54718ebe799591605eb4a3998e56f4caa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

187944 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 187944 AppLaunch.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

188204 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

188204 iexplore.exe
188204 iexplore.exe
188304 IEXPLORE.EXE
188304 IEXPLORE.EXE
188304 IEXPLORE.EXE
188304 IEXPLORE.EXE

pid	process
187944	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	187944	AppLaunch.exe

pid	process
188204	iexplore.exe

pid	process
188204	iexplore.exe
188204	iexplore.exe
188304	IEXPLORE.EXE
188304	IEXPLORE.EXE
188304	IEXPLORE.EXE
188304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

379a6a4f7be0d0e21a5e5b996ea8aeeb.exeAppLaunch.exeiexplore.exe

description	pid	process	target process
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 608 wrote to memory of 187944	608	379a6a4f7be0d0e21a5e5b996ea8aeeb.exe	AppLaunch.exe
PID 187944 wrote to memory of 188204	187944	AppLaunch.exe	iexplore.exe
PID 187944 wrote to memory of 188204	187944	AppLaunch.exe	iexplore.exe
PID 187944 wrote to memory of 188204	187944	AppLaunch.exe	iexplore.exe
PID 187944 wrote to memory of 188204	187944	AppLaunch.exe	iexplore.exe
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE
PID 188204 wrote to memory of 188304	188204	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
"C:\Users\Admin\AppData\Local\Temp\379a6a4f7be0d0e21a5e5b996ea8aeeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:187944
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://take-realprize.life/?u=lq1pd08&o=hdck0gl
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:188204
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:188204 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:188304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
345732012fdfe319a693a519b4243758

SHA1
5f380e81606e1a72b6118753ffa68199b537f37a

SHA256
83b9ced56062c5ffc817179ebe38b850404b51eb299026315a010eb4d97805e0

SHA512
6e58295fbea17e3a74e6aad226e1b3164168ce211aba869ab9502f507b8f45eb674d4a3c51fabb887dc2aa36afaa1a943067b800e6d1ef21ca6a088bf8ea04ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1BVWK5DN.txt

Filesize
607B

MD5
88e17640d0ad96d4410e30de6a82d30a

SHA1
966a46ebac7ce4424a24f6c25309e59469957be1

SHA256
3ac04aa0ef23127e3a7f365e65b5fd55f81f19c0761e62a1f8d2059f9bbebaa7

SHA512
9ab9ac37a69bdf1026f3431f5def5cdc6cdbb4e0e56e0f46ddbe819cb0760b95a1c16e21f6ac22936f749bc95adc9f9b365bf1b1fa0d9d57d5729c5cd1783fb5

Download Submit
memory/187944-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/187944-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/187944-61-0x000000000041AE1E-mapping.dmp

Download
memory/187944-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/187944-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/187944-64-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads