redline | 4be214488130c9e816fa0e0db8f9bf5e6b0ee4d0f0910e4ea4c80a3806b55047

General

Target

setup.exe
Size

7.8MB
MD5

d991180c8b4a68acbe8666da1269a2c5
SHA1

7c2e47ba170b846c02ff1a125a4dbb7e7f5fe98f
SHA256

4be214488130c9e816fa0e0db8f9bf5e6b0ee4d0f0910e4ea4c80a3806b55047
SHA512

5c75d5ff567503f9eed3084e0ee68349301e4c63d92647c65b1374a5ace8164e4cbfbaf7da727bc83f9d60b3279898547836b0099a9d32aa5e205ed074491349

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

185.200.191.18:80

Attributes

auth_value
02ec41e0225b95fefa16db6d70c6bb1e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2984-139-0x0000000000400000-0x0000000000AA9000-memory.dmp	family_redline
behavioral2/memory/215000-144-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2720-153-0x0000000000CA0000-0x0000000001AB2000-memory.dmp	family_ytstealer
behavioral2/memory/2720-162-0x0000000000CA0000-0x0000000001AB2000-memory.dmp	family_ytstealer

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

@norka16_crypted.exe5172511927.exeStarter.exe

pid process

2984 @norka16_crypted.exe
2720 5172511927.exe
216 Starter.exe

pid	process
2984	@norka16_crypted.exe
2720	5172511927.exe
216	Starter.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\5172511927.exe	upx
C:\Users\Admin\AppData\Roaming\5172511927.exe	upx
behavioral2/memory/2720-138-0x0000000000CA0000-0x0000000001AB2000-memory.dmp	upx
behavioral2/memory/2720-153-0x0000000000CA0000-0x0000000001AB2000-memory.dmp	upx
behavioral2/memory/2720-162-0x0000000000CA0000-0x0000000001AB2000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

@norka16_crypted.exe

description pid process target process

PID 2984 set thread context of 215000 2984 @norka16_crypted.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeAppLaunch.exe

pid process

4144 powershell.exe
4144 powershell.exe
215000 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AppLaunch.exepowershell.exeStarter.exe

description pid process

Token: SeDebugPrivilege 215000 AppLaunch.exe
Token: SeDebugPrivilege 4144 powershell.exe
Token: SeDebugPrivilege 216 Starter.exe

description	pid	process	target process
PID 2984 set thread context of 215000	2984	@norka16_crypted.exe	AppLaunch.exe

pid	process
4144	powershell.exe
4144	powershell.exe
215000	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	215000	AppLaunch.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	216	Starter.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

setup.exe@norka16_crypted.exe5172511927.exeAppLaunch.exe

description	pid	process	target process
PID 2432 wrote to memory of 2984	2432	setup.exe	@norka16_crypted.exe
PID 2432 wrote to memory of 2984	2432	setup.exe	@norka16_crypted.exe
PID 2432 wrote to memory of 2984	2432	setup.exe	@norka16_crypted.exe
PID 2432 wrote to memory of 2720	2432	setup.exe	5172511927.exe
PID 2432 wrote to memory of 2720	2432	setup.exe	5172511927.exe
PID 2984 wrote to memory of 215000	2984	@norka16_crypted.exe	AppLaunch.exe
PID 2984 wrote to memory of 215000	2984	@norka16_crypted.exe	AppLaunch.exe
PID 2984 wrote to memory of 215000	2984	@norka16_crypted.exe	AppLaunch.exe
PID 2984 wrote to memory of 215000	2984	@norka16_crypted.exe	AppLaunch.exe
PID 2984 wrote to memory of 215000	2984	@norka16_crypted.exe	AppLaunch.exe
PID 2720 wrote to memory of 4144	2720	5172511927.exe	powershell.exe
PID 2720 wrote to memory of 4144	2720	5172511927.exe	powershell.exe
PID 215000 wrote to memory of 216	215000	AppLaunch.exe	Starter.exe
PID 215000 wrote to memory of 216	215000	AppLaunch.exe	Starter.exe
PID 215000 wrote to memory of 216	215000	AppLaunch.exe	Starter.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe
C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:215000

C:\Users\Admin\AppData\Local\Temp\Starter.exe
"C:\Users\Admin\AppData\Local\Temp\Starter.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Users\Admin\AppData\Roaming\5172511927.exe
C:\Users\Admin\AppData\Roaming\5172511927.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "" "Get-WmiObject Win32_PortConnector"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Starter.exe

Filesize
18KB

MD5
3d41fe66e7592eb35c5ef99a83fce2a4

SHA1
5dc2984ceb1a169b5571267159c43f1b0e5d757d

SHA256
7c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198

SHA512
9ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Starter.exe

Filesize
18KB

MD5
3d41fe66e7592eb35c5ef99a83fce2a4

SHA1
5dc2984ceb1a169b5571267159c43f1b0e5d757d

SHA256
7c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198

SHA512
9ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285

Download Submit
C:\Users\Admin\AppData\Roaming\5172511927.exe

Filesize
4.0MB

MD5
78efab6b59d6eb880a806d39a0a5a674

SHA1
eb090ebe308976a84529ce5f10326242004a1323

SHA256
c6ac05d2e8cda9f3b3e9f15c33e49f6396a325e83cff62bff1ca7ca932206329

SHA512
15f8f302a3eea8a02d9005d216197c4b6824a64f564c8cbc77155ce5c503ca61e1cf69668d18e9cb44ab68189a4a35a0343cdefd8743285fc6a3871a99704f36

Download Submit
C:\Users\Admin\AppData\Roaming\5172511927.exe

Filesize
4.0MB

MD5
78efab6b59d6eb880a806d39a0a5a674

SHA1
eb090ebe308976a84529ce5f10326242004a1323

SHA256
c6ac05d2e8cda9f3b3e9f15c33e49f6396a325e83cff62bff1ca7ca932206329

SHA512
15f8f302a3eea8a02d9005d216197c4b6824a64f564c8cbc77155ce5c503ca61e1cf69668d18e9cb44ab68189a4a35a0343cdefd8743285fc6a3871a99704f36

Download Submit
C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe

Filesize
3.9MB

MD5
f95107f0601ca71bcf3b70d9a670809c

SHA1
c6cbb59475a2f7a4e03cbc0e86351dce3adf280c

SHA256
47c65f11c489643d5c62a519aeebf414ba5a8a963fb8e35280989a37a041aed5

SHA512
e562ff13791d0d7ac9d5c383236ad54a70ace6ca12ae3e32abac59fe4f94964d3bd3f53e20ad41fba69de573663e43bb7266bbc4313b699acffd749d71bfadc2

Download Submit
C:\Users\Admin\AppData\Roaming\@norka16_crypted.exe

Filesize
3.9MB

MD5
f95107f0601ca71bcf3b70d9a670809c

SHA1
c6cbb59475a2f7a4e03cbc0e86351dce3adf280c

SHA256
47c65f11c489643d5c62a519aeebf414ba5a8a963fb8e35280989a37a041aed5

SHA512
e562ff13791d0d7ac9d5c383236ad54a70ace6ca12ae3e32abac59fe4f94964d3bd3f53e20ad41fba69de573663e43bb7266bbc4313b699acffd749d71bfadc2

Download Submit
memory/216-170-0x0000000005160000-0x000000000516A000-memory.dmp

Filesize
40KB

Download
memory/216-169-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download
memory/216-166-0x0000000000000000-mapping.dmp

Download
memory/2720-138-0x0000000000CA0000-0x0000000001AB2000-memory.dmp

Filesize
14.1MB

Download
memory/2720-134-0x0000000000000000-mapping.dmp

Download
memory/2720-162-0x0000000000CA0000-0x0000000001AB2000-memory.dmp

Filesize
14.1MB

Download
memory/2720-153-0x0000000000CA0000-0x0000000001AB2000-memory.dmp

Filesize
14.1MB

Download
memory/2984-139-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/2984-132-0x0000000000000000-mapping.dmp

Download
memory/4144-159-0x0000000000000000-mapping.dmp

Download
memory/4144-161-0x00007FFD89850000-0x00007FFD8A311000-memory.dmp

Filesize
10.8MB

Download
memory/4144-160-0x000001FC75EE0000-0x000001FC75F02000-memory.dmp

Filesize
136KB

Download
memory/215000-155-0x0000000006D20000-0x0000000006DB2000-memory.dmp

Filesize
584KB

Download
memory/215000-158-0x00000000070D0000-0x00000000070EE000-memory.dmp

Filesize
120KB

Download
memory/215000-157-0x0000000006FB0000-0x0000000007026000-memory.dmp

Filesize
472KB

Download
memory/215000-156-0x0000000006DC0000-0x0000000006E26000-memory.dmp

Filesize
408KB

Download
memory/215000-154-0x00000000071D0000-0x0000000007774000-memory.dmp

Filesize
5.6MB

Download
memory/215000-152-0x00000000059A0000-0x00000000059DC000-memory.dmp

Filesize
240KB

Download
memory/215000-163-0x0000000008900000-0x0000000008AC2000-memory.dmp

Filesize
1.8MB

Download
memory/215000-164-0x0000000009000000-0x000000000952C000-memory.dmp

Filesize
5.2MB

Download
memory/215000-165-0x0000000007D10000-0x0000000007D60000-memory.dmp

Filesize
320KB

Download
memory/215000-151-0x0000000005A70000-0x0000000005B7A000-memory.dmp

Filesize
1.0MB

Download
memory/215000-150-0x0000000005940000-0x0000000005952000-memory.dmp

Filesize
72KB

Download
memory/215000-149-0x0000000005F00000-0x0000000006518000-memory.dmp

Filesize
6.1MB

Download
memory/215000-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/215000-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads