redline | 9d7f63ff52fbd0c5850a599fc8e3b6999fc93b742333d85275db9ee547c4348a

General

Target

Document.pdf.exe
Size

362.9MB
MD5

23531c33d025a8e7466511284ecaf046
SHA1

f93032d253b36df7a339a22bacfd3aaf2827a1af
SHA256

9d7f63ff52fbd0c5850a599fc8e3b6999fc93b742333d85275db9ee547c4348a
SHA512

3430525b0a078bd3e2af8e5c1ffc2b99319487d9736924c98a937a771aeb26908f711a01ea1208553f29e11f146d12285fbca53b71209e00668e023af7fc51a8

Score

10^/10

redline 10 infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

10

C2

62.204.41.139:25190

Attributes

auth_value
34b5c518a86dd5ef3600c8dca14edb7e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3156-147-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

SETUP_~2.EXE

pid process

964 SETUP_~2.EXE

pid	process
964	SETUP_~2.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SETUP_~2.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	SETUP_~2.EXE

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Document.pdf.exeSETUP_~2.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Document.pdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Document.pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Synch_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\DSynch\\Synch_1.exe\""	SETUP_~2.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

SETUP_~2.EXE

description pid process target process

PID 964 set thread context of 3156 964 SETUP_~2.EXE InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exeSETUP_~2.EXEInstallUtil.exe

pid process

1036 powershell.exe
1036 powershell.exe
964 SETUP_~2.EXE
964 SETUP_~2.EXE
3156 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SETUP_~2.EXEpowershell.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 964 SETUP_~2.EXE
Token: SeDebugPrivilege 1036 powershell.exe
Token: SeDebugPrivilege 3156 InstallUtil.exe

description	pid	process	target process
PID 964 set thread context of 3156	964	SETUP_~2.EXE	InstallUtil.exe

pid	process
1036	powershell.exe
1036	powershell.exe
964	SETUP_~2.EXE
964	SETUP_~2.EXE
3156	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	964	SETUP_~2.EXE
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	3156	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Document.pdf.exeSETUP_~2.EXE

description	pid	process	target process
PID 2636 wrote to memory of 964	2636	Document.pdf.exe	SETUP_~2.EXE
PID 2636 wrote to memory of 964	2636	Document.pdf.exe	SETUP_~2.EXE
PID 2636 wrote to memory of 964	2636	Document.pdf.exe	SETUP_~2.EXE
PID 964 wrote to memory of 1036	964	SETUP_~2.EXE	powershell.exe
PID 964 wrote to memory of 1036	964	SETUP_~2.EXE	powershell.exe
PID 964 wrote to memory of 1036	964	SETUP_~2.EXE	powershell.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe
PID 964 wrote to memory of 3156	964	SETUP_~2.EXE	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Document.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Document.pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
Filesize
333.8MB

MD5
eb7ff434c93e6bf312ad028178e25183

SHA1
bbea766fe135a3ef4e9e13f3e5c933a22a9adeed

SHA256
7b4b6a198ec51d960953b6b973985096fa796927fdd1b0552e7455a725c2ea0b

SHA512
56ce9597203a3b960d0824036dfa693f31d81815effdeecc843c7d1d0c4e8c71396d5bb232cc39eff34fefce1eac29d7753cc19f2f0873690bba8ce853d3a874

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE
Filesize
333.8MB

MD5
eb7ff434c93e6bf312ad028178e25183

SHA1
bbea766fe135a3ef4e9e13f3e5c933a22a9adeed

SHA256
7b4b6a198ec51d960953b6b973985096fa796927fdd1b0552e7455a725c2ea0b

SHA512
56ce9597203a3b960d0824036dfa693f31d81815effdeecc843c7d1d0c4e8c71396d5bb232cc39eff34fefce1eac29d7753cc19f2f0873690bba8ce853d3a874

Download Submit
memory/964-130-0x0000000000000000-mapping.dmp

Download
memory/964-133-0x0000000000A90000-0x0000000000AA0000-memory.dmp

Filesize
64KB

Download
memory/964-134-0x00000000059A0000-0x0000000005F44000-memory.dmp

Filesize
5.6MB

Download
memory/964-135-0x00000000055D0000-0x0000000005662000-memory.dmp

Filesize
584KB

Download
memory/964-136-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/964-137-0x0000000007BB0000-0x0000000007BD2000-memory.dmp

Filesize
136KB

Download
memory/1036-142-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Filesize
408KB

Download
memory/1036-139-0x0000000002850000-0x0000000002886000-memory.dmp

Filesize
216KB

Download
memory/1036-140-0x0000000005290000-0x00000000058B8000-memory.dmp

Filesize
6.2MB

Download
memory/1036-141-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/1036-138-0x0000000000000000-mapping.dmp

Download
memory/1036-143-0x0000000006120000-0x000000000613E000-memory.dmp

Filesize
120KB

Download
memory/1036-145-0x0000000006630000-0x000000000664A000-memory.dmp

Filesize
104KB

Download
memory/1036-144-0x00000000079C0000-0x000000000803A000-memory.dmp

Filesize
6.5MB

Download
memory/3156-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3156-146-0x0000000000000000-mapping.dmp

Download
memory/3156-148-0x0000000006300000-0x0000000006918000-memory.dmp

Filesize
6.1MB

Download
memory/3156-149-0x0000000007B80000-0x0000000007B92000-memory.dmp

Filesize
72KB

Download
memory/3156-150-0x0000000007CB0000-0x0000000007DBA000-memory.dmp

Filesize
1.0MB

Download
memory/3156-151-0x0000000005D20000-0x0000000005D5C000-memory.dmp

Filesize
240KB

Download
memory/3156-152-0x0000000005B00000-0x0000000005B76000-memory.dmp

Filesize
472KB

Download
memory/3156-153-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Filesize
120KB

Download
memory/3156-154-0x0000000007C10000-0x0000000007C60000-memory.dmp

Filesize
320KB

Download
memory/3156-155-0x00000000095A0000-0x0000000009762000-memory.dmp

Filesize
1.8MB

Download
memory/3156-156-0x0000000009CA0000-0x000000000A1CC000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads