redline | b496d857bbbef7e54fb21211543f3773d0217531f45e5ae8f781a6a2105bd9ce

Analysis

max time kernel
124s
max time network
134s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe
Size

2.5MB
MD5

7e14b59e3e02f958d30d433d049ba87f
SHA1

56654f6eef3439ee707338b67fdcfffa371dff6c
SHA256

b496d857bbbef7e54fb21211543f3773d0217531f45e5ae8f781a6a2105bd9ce
SHA512

f600e6ce13bc5f8f510ff3dfaf7bb565adce02132e411e0aafbfe7284b109a46b7eee6be339b8041fdc1d2f0e64e8280611053394cd0c1f3c9166c9c0141242a

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

185.215.113.83:60722

Attributes

auth_value
d6602ca99e3633ec2776f94702ca62f2

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/197188-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/197188-61-0x000000000041B4EE-mapping.dmp	family_redline
behavioral1/memory/197188-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/197188-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe

description	pid	process	target process
PID 2032 set thread context of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

197188 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 197188 AppLaunch.exe

pid	process
197188	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	197188	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe

description	pid	process	target process
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe
PID 2032 wrote to memory of 197188	2032	B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe
"C:\Users\Admin\AppData\Local\Temp\B496D857BBBEF7E54FB21211543F3773D0217531F45E5AE8F781A6A2105BD9CE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:197188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/197188-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/197188-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/197188-61-0x000000000041B4EE-mapping.dmp

Download
memory/197188-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/197188-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/197188-64-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download