redline | 4be214488130c9e816fa0e0db8f9bf5e6b0ee4d0f0910e4ea4c80a3806b55047

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/08/2022, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

7.8MB
MD5

d991180c8b4a68acbe8666da1269a2c5
SHA1

7c2e47ba170b846c02ff1a125a4dbb7e7f5fe98f
SHA256

4be214488130c9e816fa0e0db8f9bf5e6b0ee4d0f0910e4ea4c80a3806b55047
SHA512

5c75d5ff567503f9eed3084e0ee68349301e4c63d92647c65b1374a5ace8164e4cbfbaf7da727bc83f9d60b3279898547836b0099a9d32aa5e205ed074491349

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

185.200.191.18:80

Attributes

auth_value
02ec41e0225b95fefa16db6d70c6bb1e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/684-64-0x0000000000400000-0x0000000000AA9000-memory.dmp	family_redline
behavioral1/memory/130472-71-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/130472-76-0x000000000041A7DE-mapping.dmp	family_redline
behavioral1/memory/130472-77-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/130472-78-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/1320-68-0x00000000008D0000-0x00000000016E2000-memory.dmp	family_ytstealer
behavioral1/memory/1320-80-0x00000000008D0000-0x00000000016E2000-memory.dmp	family_ytstealer

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
684	@norka16_crypted.exe
1320	5172511927.exe
130972	Starter.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012315-62.dat	upx
behavioral1/files/0x000b000000012315-60.dat	upx
behavioral1/files/0x000b000000012315-59.dat	upx
behavioral1/memory/1320-68-0x00000000008D0000-0x00000000016E2000-memory.dmp	upx
behavioral1/memory/1320-80-0x00000000008D0000-0x00000000016E2000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1044	setup.exe
1044	setup.exe
1044	setup.exe
1044	setup.exe
130472	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 684 set thread context of 130472	684	@norka16_crypted.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
130472	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	130472	AppLaunch.exe
Token: SeDebugPrivilege	130972	Starter.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 684	1044	setup.exe	27
PID 1044 wrote to memory of 684	1044	setup.exe	27
PID 1044 wrote to memory of 684	1044	setup.exe	27
PID 1044 wrote to memory of 684	1044	setup.exe	27
PID 1044 wrote to memory of 1320	1044	setup.exe	29
PID 1044 wrote to memory of 1320	1044	setup.exe	29
PID 1044 wrote to memory of 1320	1044	setup.exe	29
PID 1044 wrote to memory of 1320	1044	setup.exe	29
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 684 wrote to memory of 130472	684	@norka16_crypted.exe	30
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32
PID 130472 wrote to memory of 130972	130472	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe
  C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:130472
  - - C:\Users\Admin\AppData\Local\Temp\Starter.exe
      "C:\Users\Admin\AppData\Local\Temp\Starter.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:130972
- C:\Users\Admin\AppData\Roaming\5172511927.exe
  C:\Users\Admin\AppData\Roaming\5172511927.exe
  2⤵
  - Executes dropped EXE
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Starter.exe

Filesize
18KB

MD5
3d41fe66e7592eb35c5ef99a83fce2a4

SHA1
5dc2984ceb1a169b5571267159c43f1b0e5d757d

SHA256
7c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198

SHA512
9ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Starter.exe

Filesize
18KB

MD5
3d41fe66e7592eb35c5ef99a83fce2a4

SHA1
5dc2984ceb1a169b5571267159c43f1b0e5d757d

SHA256
7c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198

SHA512
9ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285

Download Submit
C:\Users\Admin\AppData\Roaming\5172511927.exe

Filesize
4.0MB

MD5
78efab6b59d6eb880a806d39a0a5a674

SHA1
eb090ebe308976a84529ce5f10326242004a1323

SHA256
c6ac05d2e8cda9f3b3e9f15c33e49f6396a325e83cff62bff1ca7ca932206329

SHA512
15f8f302a3eea8a02d9005d216197c4b6824a64f564c8cbc77155ce5c503ca61e1cf69668d18e9cb44ab68189a4a35a0343cdefd8743285fc6a3871a99704f36

Download Submit
C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe

Filesize
3.9MB

MD5
f95107f0601ca71bcf3b70d9a670809c

SHA1
c6cbb59475a2f7a4e03cbc0e86351dce3adf280c

SHA256
47c65f11c489643d5c62a519aeebf414ba5a8a963fb8e35280989a37a041aed5

SHA512
e562ff13791d0d7ac9d5c383236ad54a70ace6ca12ae3e32abac59fe4f94964d3bd3f53e20ad41fba69de573663e43bb7266bbc4313b699acffd749d71bfadc2

Download Submit
\Users\Admin\AppData\Local\Temp\Starter.exe

Filesize
18KB

MD5
3d41fe66e7592eb35c5ef99a83fce2a4

SHA1
5dc2984ceb1a169b5571267159c43f1b0e5d757d

SHA256
7c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198

SHA512
9ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285

Download Submit
\Users\Admin\AppData\Roaming\5172511927.exe

Filesize
4.0MB

MD5
78efab6b59d6eb880a806d39a0a5a674

SHA1
eb090ebe308976a84529ce5f10326242004a1323

SHA256
c6ac05d2e8cda9f3b3e9f15c33e49f6396a325e83cff62bff1ca7ca932206329

SHA512
15f8f302a3eea8a02d9005d216197c4b6824a64f564c8cbc77155ce5c503ca61e1cf69668d18e9cb44ab68189a4a35a0343cdefd8743285fc6a3871a99704f36

Download Submit
\Users\Admin\AppData\Roaming\5172511927.exe

Filesize
4.0MB

MD5
78efab6b59d6eb880a806d39a0a5a674

SHA1
eb090ebe308976a84529ce5f10326242004a1323

SHA256
c6ac05d2e8cda9f3b3e9f15c33e49f6396a325e83cff62bff1ca7ca932206329

SHA512
15f8f302a3eea8a02d9005d216197c4b6824a64f564c8cbc77155ce5c503ca61e1cf69668d18e9cb44ab68189a4a35a0343cdefd8743285fc6a3871a99704f36

Download Submit
\Users\Admin\AppData\Roaming\@norka16_crypted.exe

Filesize
3.9MB

MD5
f95107f0601ca71bcf3b70d9a670809c

SHA1
c6cbb59475a2f7a4e03cbc0e86351dce3adf280c

SHA256
47c65f11c489643d5c62a519aeebf414ba5a8a963fb8e35280989a37a041aed5

SHA512
e562ff13791d0d7ac9d5c383236ad54a70ace6ca12ae3e32abac59fe4f94964d3bd3f53e20ad41fba69de573663e43bb7266bbc4313b699acffd749d71bfadc2

Download Submit
\Users\Admin\AppData\Roaming\@norka16_crypted.exe

Filesize
3.9MB

MD5
f95107f0601ca71bcf3b70d9a670809c

SHA1
c6cbb59475a2f7a4e03cbc0e86351dce3adf280c

SHA256
47c65f11c489643d5c62a519aeebf414ba5a8a963fb8e35280989a37a041aed5

SHA512
e562ff13791d0d7ac9d5c383236ad54a70ace6ca12ae3e32abac59fe4f94964d3bd3f53e20ad41fba69de573663e43bb7266bbc4313b699acffd749d71bfadc2

Download Submit
memory/684-64-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/1044-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1044-63-0x0000000002540000-0x0000000003352000-memory.dmp

Filesize
14.1MB

Download
memory/1320-80-0x00000000008D0000-0x00000000016E2000-memory.dmp

Filesize
14.1MB

Download
memory/1320-68-0x00000000008D0000-0x00000000016E2000-memory.dmp

Filesize
14.1MB

Download
memory/130472-77-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/130472-78-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/130472-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/130472-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/130972-86-0x00000000012E0000-0x00000000012EA000-memory.dmp

Filesize
40KB

Download