redline | 0af383db909c314a9e69f1266dd8f50b11816a26d3ff26b5b32f0bf8574f410b

General

Target

setup.exe
Size

4.9MB
MD5

f282768e11d3b0f9543a4dce4e51d563
SHA1

c71b735210380cd0a53db2b4d781cddc5c418fa5
SHA256

0af383db909c314a9e69f1266dd8f50b11816a26d3ff26b5b32f0bf8574f410b
SHA512

6001628abccb1fc01a5a92fb3e91278b1aefe9b2a05b40d98ed577a4bf9a05ec385d12504874a3be1786b5c7e3a5e42bf89530bb935c83a5d4d2b090d4d57995
SSDEEP

98304:iCnkht4Wom20+2hlWDLh88t+IRnBgObfsyzy7seBmhgdOkEWDQPfrSy38km:ibhtgP2hliLXFsyzy7fmMWrSy33m

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

185.200.191.18:80

Attributes

auth_value
8e735c61c3e52e58f4665d971fce8806

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/147036-140-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer
behavioral2/memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer
behavioral2/memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer

Executes dropped EXE 2 IoCs

Processes:

@sp1keeeeee_crypted.exe1859736053.exe

pid process

800 @sp1keeeeee_crypted.exe
6940 1859736053.exe

pid	process
800	@sp1keeeeee_crypted.exe
6940	1859736053.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\1859736053.exe	upx
C:\Users\Admin\AppData\Roaming\1859736053.exe	upx
behavioral2/memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx
behavioral2/memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx
behavioral2/memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

@sp1keeeeee_crypted.exe

description pid process target process

PID 800 set thread context of 147036 800 @sp1keeeeee_crypted.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeAppLaunch.exe

pid process

147248 powershell.exe
147248 powershell.exe
147036 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AppLaunch.exepowershell.exe

description pid process

Token: SeDebugPrivilege 147036 AppLaunch.exe
Token: SeDebugPrivilege 147248 powershell.exe

description	pid	process	target process
PID 800 set thread context of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe

pid	process
147248	powershell.exe
147248	powershell.exe
147036	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	147036	AppLaunch.exe
Token: SeDebugPrivilege	147248	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

setup.exe@sp1keeeeee_crypted.exe1859736053.exe

description	pid	process	target process
PID 2324 wrote to memory of 800	2324	setup.exe	@sp1keeeeee_crypted.exe
PID 2324 wrote to memory of 800	2324	setup.exe	@sp1keeeeee_crypted.exe
PID 2324 wrote to memory of 800	2324	setup.exe	@sp1keeeeee_crypted.exe
PID 2324 wrote to memory of 6940	2324	setup.exe	1859736053.exe
PID 2324 wrote to memory of 6940	2324	setup.exe	1859736053.exe
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	AppLaunch.exe
PID 6940 wrote to memory of 147248	6940	1859736053.exe	powershell.exe
PID 6940 wrote to memory of 147248	6940	1859736053.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:147036

C:\Users\Admin\AppData\Roaming\1859736053.exe
C:\Users\Admin\AppData\Roaming\1859736053.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "" "Get-WmiObject Win32_PortConnector"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:147248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1859736053.exe
Filesize
4.0MB

MD5
10b2a9cc7dec335b598856c1974da4fa

SHA1
b95755e2693c58359910bec6e8d0d57051f1ef6f

SHA256
dc678f956695d21ae414b3df2541183fa3641457492e8337e9b74b563f2bc124

SHA512
6f4728899e90f36a27cf106184520b642f72ff54c0ff04a8c069ee33b7a00cee77c3ec2e957a6ff306b17bc6e16e987e284d9015e322325ea5042ee9edd33140

Download Submit
C:\Users\Admin\AppData\Roaming\1859736053.exe
Filesize
4.0MB

MD5
10b2a9cc7dec335b598856c1974da4fa

SHA1
b95755e2693c58359910bec6e8d0d57051f1ef6f

SHA256
dc678f956695d21ae414b3df2541183fa3641457492e8337e9b74b563f2bc124

SHA512
6f4728899e90f36a27cf106184520b642f72ff54c0ff04a8c069ee33b7a00cee77c3ec2e957a6ff306b17bc6e16e987e284d9015e322325ea5042ee9edd33140

Download Submit
C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
Filesize
2.4MB

MD5
8f2ef7ab3520eccf48d2d32bab887447

SHA1
69237aae807f04e2160475aee36c10a66582bad6

SHA256
6bdd0a39b62d6c0e351fcd504c5430fae0b3e4d8457e0b9f78f69a490b590693

SHA512
8a2276eb3f44227fe6737d83206f09cf33a294ee86834cb7fcf074d0337705cbe68236d19e5dfba55b5c32e281bfcf7d046309e86fb72f2a6829262dae45e5b5

Download Submit
C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
Filesize
2.4MB

MD5
8f2ef7ab3520eccf48d2d32bab887447

SHA1
69237aae807f04e2160475aee36c10a66582bad6

SHA256
6bdd0a39b62d6c0e351fcd504c5430fae0b3e4d8457e0b9f78f69a490b590693

SHA512
8a2276eb3f44227fe6737d83206f09cf33a294ee86834cb7fcf074d0337705cbe68236d19e5dfba55b5c32e281bfcf7d046309e86fb72f2a6829262dae45e5b5

Download Submit
memory/800-132-0x0000000000000000-mapping.dmp

Download
memory/6940-135-0x0000000000000000-mapping.dmp

Download
memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/147036-148-0x0000000005410000-0x000000000544C000-memory.dmp

Filesize
240KB

Download
memory/147036-154-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/147036-147-0x00000000054E0000-0x00000000055EA000-memory.dmp

Filesize
1.0MB

Download
memory/147036-146-0x00000000053B0000-0x00000000053C2000-memory.dmp

Filesize
72KB

Download
memory/147036-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147036-150-0x0000000006700000-0x0000000006766000-memory.dmp

Filesize
408KB

Download
memory/147036-151-0x0000000006920000-0x0000000006996000-memory.dmp

Filesize
472KB

Download
memory/147036-152-0x0000000006A70000-0x0000000006B02000-memory.dmp

Filesize
584KB

Download
memory/147036-153-0x00000000070C0000-0x0000000007664000-memory.dmp

Filesize
5.6MB

Download
memory/147036-145-0x0000000005910000-0x0000000005F28000-memory.dmp

Filesize
6.1MB

Download
memory/147036-155-0x00000000082F0000-0x00000000084B2000-memory.dmp

Filesize
1.8MB

Download
memory/147036-156-0x00000000089F0000-0x0000000008F1C000-memory.dmp

Filesize
5.2MB

Download
memory/147036-139-0x0000000000000000-mapping.dmp

Download
memory/147036-160-0x00000000077C0000-0x0000000007810000-memory.dmp

Filesize
320KB

Download
memory/147248-159-0x00007FFC913D0000-0x00007FFC91E91000-memory.dmp

Filesize
10.8MB

Download
memory/147248-158-0x0000015504160000-0x0000015504182000-memory.dmp

Filesize
136KB

Download
memory/147248-157-0x0000000000000000-mapping.dmp

Download
memory/147248-162-0x00007FFC913D0000-0x00007FFC91E91000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads