redline | 0af383db909c314a9e69f1266dd8f50b11816a26d3ff26b5b32f0bf8574f410b

General

Target

setup.exe
Size

4.9MB
MD5

f282768e11d3b0f9543a4dce4e51d563
SHA1

c71b735210380cd0a53db2b4d781cddc5c418fa5
SHA256

0af383db909c314a9e69f1266dd8f50b11816a26d3ff26b5b32f0bf8574f410b
SHA512

6001628abccb1fc01a5a92fb3e91278b1aefe9b2a05b40d98ed577a4bf9a05ec385d12504874a3be1786b5c7e3a5e42bf89530bb935c83a5d4d2b090d4d57995
SSDEEP

98304:iCnkht4Wom20+2hlWDLh88t+IRnBgObfsyzy7seBmhgdOkEWDQPfrSy38km:ibhtgP2hliLXFsyzy7fmMWrSy33m

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

185.200.191.18:80

Attributes

auth_value
8e735c61c3e52e58f4665d971fce8806

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/147036-140-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer
behavioral2/memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer
behavioral2/memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp	family_ytstealer

Executes dropped EXE 2 IoCs

pid	Process
800	@sp1keeeeee_crypted.exe
6940	1859736053.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e44-137.dat	upx
behavioral2/files/0x0006000000022e44-136.dat	upx
behavioral2/memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx
behavioral2/memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx
behavioral2/memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 147036	800	@sp1keeeeee_crypted.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
147248	powershell.exe
147248	powershell.exe
147036	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	147036	AppLaunch.exe
Token: SeDebugPrivilege	147248	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 800	2324	setup.exe	82
PID 2324 wrote to memory of 800	2324	setup.exe	82
PID 2324 wrote to memory of 800	2324	setup.exe	82
PID 2324 wrote to memory of 6940	2324	setup.exe	84
PID 2324 wrote to memory of 6940	2324	setup.exe	84
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	85
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	85
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	85
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	85
PID 800 wrote to memory of 147036	800	@sp1keeeeee_crypted.exe	85
PID 6940 wrote to memory of 147248	6940	1859736053.exe	86
PID 6940 wrote to memory of 147248	6940	1859736053.exe	86

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
  C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:147036
- C:\Users\Admin\AppData\Roaming\1859736053.exe
  C:\Users\Admin\AppData\Roaming\1859736053.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "Get-WmiObject Win32_PortConnector"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:147248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1859736053.exe

Filesize
4.0MB

MD5
10b2a9cc7dec335b598856c1974da4fa

SHA1
b95755e2693c58359910bec6e8d0d57051f1ef6f

SHA256
dc678f956695d21ae414b3df2541183fa3641457492e8337e9b74b563f2bc124

SHA512
6f4728899e90f36a27cf106184520b642f72ff54c0ff04a8c069ee33b7a00cee77c3ec2e957a6ff306b17bc6e16e987e284d9015e322325ea5042ee9edd33140

Download Submit
C:\Users\Admin\AppData\Roaming\1859736053.exe

Filesize
4.0MB

MD5
10b2a9cc7dec335b598856c1974da4fa

SHA1
b95755e2693c58359910bec6e8d0d57051f1ef6f

SHA256
dc678f956695d21ae414b3df2541183fa3641457492e8337e9b74b563f2bc124

SHA512
6f4728899e90f36a27cf106184520b642f72ff54c0ff04a8c069ee33b7a00cee77c3ec2e957a6ff306b17bc6e16e987e284d9015e322325ea5042ee9edd33140

Download Submit
C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe

Filesize
2.4MB

MD5
8f2ef7ab3520eccf48d2d32bab887447

SHA1
69237aae807f04e2160475aee36c10a66582bad6

SHA256
6bdd0a39b62d6c0e351fcd504c5430fae0b3e4d8457e0b9f78f69a490b590693

SHA512
8a2276eb3f44227fe6737d83206f09cf33a294ee86834cb7fcf074d0337705cbe68236d19e5dfba55b5c32e281bfcf7d046309e86fb72f2a6829262dae45e5b5

Download Submit
C:\Users\Admin\AppData\Roaming\@sp1keeeeee_crypted.exe

Filesize
2.4MB

MD5
8f2ef7ab3520eccf48d2d32bab887447

SHA1
69237aae807f04e2160475aee36c10a66582bad6

SHA256
6bdd0a39b62d6c0e351fcd504c5430fae0b3e4d8457e0b9f78f69a490b590693

SHA512
8a2276eb3f44227fe6737d83206f09cf33a294ee86834cb7fcf074d0337705cbe68236d19e5dfba55b5c32e281bfcf7d046309e86fb72f2a6829262dae45e5b5

Download Submit
memory/6940-138-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/6940-161-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/6940-149-0x0000000000F10000-0x0000000001D24000-memory.dmp

Filesize
14.1MB

Download
memory/147036-148-0x0000000005410000-0x000000000544C000-memory.dmp

Filesize
240KB

Download
memory/147036-154-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/147036-147-0x00000000054E0000-0x00000000055EA000-memory.dmp

Filesize
1.0MB

Download
memory/147036-146-0x00000000053B0000-0x00000000053C2000-memory.dmp

Filesize
72KB

Download
memory/147036-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147036-150-0x0000000006700000-0x0000000006766000-memory.dmp

Filesize
408KB

Download
memory/147036-151-0x0000000006920000-0x0000000006996000-memory.dmp

Filesize
472KB

Download
memory/147036-152-0x0000000006A70000-0x0000000006B02000-memory.dmp

Filesize
584KB

Download
memory/147036-153-0x00000000070C0000-0x0000000007664000-memory.dmp

Filesize
5.6MB

Download
memory/147036-145-0x0000000005910000-0x0000000005F28000-memory.dmp

Filesize
6.1MB

Download
memory/147036-155-0x00000000082F0000-0x00000000084B2000-memory.dmp

Filesize
1.8MB

Download
memory/147036-156-0x00000000089F0000-0x0000000008F1C000-memory.dmp

Filesize
5.2MB

Download
memory/147036-160-0x00000000077C0000-0x0000000007810000-memory.dmp

Filesize
320KB

Download
memory/147248-159-0x00007FFC913D0000-0x00007FFC91E91000-memory.dmp

Filesize
10.8MB

Download
memory/147248-158-0x0000015504160000-0x0000015504182000-memory.dmp

Filesize
136KB

Download
memory/147248-162-0x00007FFC913D0000-0x00007FFC91E91000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing