redline | 5cf09ada20a1467a9f031f8253ca916e3a61d1a399ad64153e63d6ed140f7ee3

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-09-2022 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.2MB
MD5

106adc0183d444263d6675db1a2e9540
SHA1

d4479ce12196290bea418795e36628a136021949
SHA256

5cf09ada20a1467a9f031f8253ca916e3a61d1a399ad64153e63d6ed140f7ee3
SHA512

921aa6487e6bb524fab9dad94b59c65f2a567965d845490fd5ada5c27be3e23889d22700591ca581cf639c6662b33d61d3e42b2fe87a52482050edd5a91110fb
SSDEEP

49152:F70aLyun15F4UfHlSQWeBGnWSglFJp+uRp4LgCBAvQlAXHzziRy2oqIR7R4j:FAaLyun15FHnJsWJ0oH4lAgSJR2

Score

10^/10

redline 5 discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

116.203.187.3:14916

Attributes

auth_value
febe6965b41d2583ad2bb6b5aa23cfd5

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/676-72-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/676-71-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/676-73-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/676-74-0x000000000041ADBA-mapping.dmp	family_redline
behavioral1/memory/676-78-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/676-76-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

mnr.exemnr.exe

pid process

1932 mnr.exe
1572 mnr.exe
Loads dropped DLL 2 IoCs

Processes:

file.exetaskeng.exe

pid process

676 file.exe
1376 taskeng.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1932	mnr.exe
1572	mnr.exe

pid	process
676	file.exe
1376	taskeng.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tehtosfc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gsvigc\\Tehtosfc.exe\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 940 set thread context of 676 940 file.exe file.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exefile.exepowershell.exefile.exepowershell.exe

pid process

1472 powershell.exe
940 file.exe
1336 powershell.exe
676 file.exe
540 powershell.exe

description	pid	process	target process
PID 940 set thread context of 676	940	file.exe	file.exe

pid	process
1472	powershell.exe
940	file.exe
1336	powershell.exe
676	file.exe
540	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exefile.exepowershell.exefile.exemnr.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	940	file.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	676	file.exe
Token: SeDebugPrivilege	1932	mnr.exe
Token: SeDebugPrivilege	540	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

file.exefile.exemnr.exetaskeng.exe

description	pid	process	target process
PID 940 wrote to memory of 1472	940	file.exe	powershell.exe
PID 940 wrote to memory of 1472	940	file.exe	powershell.exe
PID 940 wrote to memory of 1472	940	file.exe	powershell.exe
PID 940 wrote to memory of 1472	940	file.exe	powershell.exe
PID 940 wrote to memory of 1336	940	file.exe	powershell.exe
PID 940 wrote to memory of 1336	940	file.exe	powershell.exe
PID 940 wrote to memory of 1336	940	file.exe	powershell.exe
PID 940 wrote to memory of 1336	940	file.exe	powershell.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 940 wrote to memory of 676	940	file.exe	file.exe
PID 676 wrote to memory of 1932	676	file.exe	mnr.exe
PID 676 wrote to memory of 1932	676	file.exe	mnr.exe
PID 676 wrote to memory of 1932	676	file.exe	mnr.exe
PID 676 wrote to memory of 1932	676	file.exe	mnr.exe
PID 1932 wrote to memory of 540	1932	mnr.exe	powershell.exe
PID 1932 wrote to memory of 540	1932	mnr.exe	powershell.exe
PID 1932 wrote to memory of 540	1932	mnr.exe	powershell.exe
PID 1376 wrote to memory of 1572	1376	taskeng.exe	mnr.exe
PID 1376 wrote to memory of 1572	1376	taskeng.exe	mnr.exe
PID 1376 wrote to memory of 1572	1376	taskeng.exe	mnr.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 30
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\file.exe
  C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Users\Admin\AppData\Local\Temp\mnr.exe
    "C:\Users\Admin\AppData\Local\Temp\mnr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:540

C:\Windows\system32\taskeng.exe
taskeng.exe {D1E556C8-D857-4BDD-B033-F857A07FC714} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Roaming\mnr.exe
  C:\Users\Admin\AppData\Roaming\mnr.exe
  2⤵
  - Executes dropped EXE
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1d644f1f9e4ab38d6b11e7264c10732d

SHA1
e120d38c6000034095be82fd0348292ac5b5fded

SHA256
63caa9114e2c93633a365ce604b35c2e46f76b160c1682216b3522e864ef4dbf

SHA512
bc1f7f512125861478e9c8a92345b17c9baf3723243c3dc32c2978cf96175b764844db08c954ff776857e7bed09d992876b7845a464248f58b32fa7820e7a4e9

Download Submit
C:\Users\Admin\AppData\Roaming\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
C:\Users\Admin\AppData\Roaming\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
\Users\Admin\AppData\Roaming\mnr.exe

Filesize
1.1MB

MD5
83f5b59561ffd68339e06f5e007537bf

SHA1
235df5c30aeba5f1f2fa93ea93a18f31f863460d

SHA256
dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a

SHA512
cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7

Download Submit
memory/540-121-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/540-123-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/540-125-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/540-126-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/540-118-0x000007FEED2D0000-0x000007FEEDE2D000-memory.dmp

Filesize
11.4MB

Download
memory/540-119-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/540-117-0x000007FEEDE30000-0x000007FEEE853000-memory.dmp

Filesize
10.1MB

Download
memory/540-116-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/540-115-0x0000000000000000-mapping.dmp

Download
memory/676-78-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-74-0x000000000041ADBA-mapping.dmp

Download
memory/676-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/676-112-0x00000000069F0000-0x0000000006B08000-memory.dmp

Filesize
1.1MB

Download
memory/676-97-0x00000000069F0000-0x0000000006B08000-memory.dmp

Filesize
1.1MB

Download
memory/940-60-0x00000000054D0000-0x00000000056F4000-memory.dmp

Filesize
2.1MB

Download
memory/940-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/940-54-0x0000000000170000-0x00000000003A6000-memory.dmp

Filesize
2.2MB

Download
memory/1336-67-0x000000006FE30000-0x00000000703DB000-memory.dmp

Filesize
5.7MB

Download
memory/1336-61-0x0000000000000000-mapping.dmp

Download
memory/1336-65-0x000000006FE30000-0x00000000703DB000-memory.dmp

Filesize
5.7MB

Download
memory/1336-66-0x000000006FE30000-0x00000000703DB000-memory.dmp

Filesize
5.7MB

Download
memory/1376-145-0x000000013FDB0000-0x000000013FEC8000-memory.dmp

Filesize
1.1MB

Download
memory/1472-59-0x0000000071B40000-0x00000000720EB000-memory.dmp

Filesize
5.7MB

Download
memory/1472-58-0x0000000071B40000-0x00000000720EB000-memory.dmp

Filesize
5.7MB

Download
memory/1472-56-0x0000000000000000-mapping.dmp

Download
memory/1572-129-0x0000000000000000-mapping.dmp

Download
memory/1572-134-0x000007FEFB770000-0x000007FEFB7DF000-memory.dmp

Filesize
444KB

Download
memory/1572-152-0x000007FEF6CC0000-0x000007FEF6DEC000-memory.dmp

Filesize
1.2MB

Download
memory/1572-151-0x000000013FDB0000-0x000000013FEC8000-memory.dmp

Filesize
1.1MB

Download
memory/1572-150-0x000007FEFC0E0000-0x000007FEFC136000-memory.dmp

Filesize
344KB

Download
memory/1572-149-0x000007FEFFB40000-0x000007FEFFD43000-memory.dmp

Filesize
2.0MB

Download
memory/1572-148-0x000007FEFDD90000-0x000007FEFDEBD000-memory.dmp

Filesize
1.2MB

Download
memory/1572-147-0x0000000000510000-0x0000000000552000-memory.dmp

Filesize
264KB

Download
memory/1572-146-0x000000013FDB0000-0x000000013FEC8000-memory.dmp

Filesize
1.1MB

Download
memory/1572-144-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1572-143-0x000007FEFDEC0000-0x000007FEFDF9B000-memory.dmp

Filesize
876KB

Download
memory/1572-142-0x000007FEF6DF0000-0x000007FEF6EE7000-memory.dmp

Filesize
988KB

Download
memory/1572-141-0x000007FEFFAC0000-0x000007FEFFB31000-memory.dmp

Filesize
452KB

Download
memory/1572-140-0x000007FEFDA40000-0x000007FEFDAAC000-memory.dmp

Filesize
432KB

Download
memory/1572-139-0x0000000077820000-0x000000007793F000-memory.dmp

Filesize
1.1MB

Download
memory/1572-138-0x000007FEFDCF0000-0x000007FEFDD8F000-memory.dmp

Filesize
636KB

Download
memory/1572-135-0x000007FEF7090000-0x000007FEF712C000-memory.dmp

Filesize
624KB

Download
memory/1572-136-0x000007FEFE5C0000-0x000007FEFE627000-memory.dmp

Filesize
412KB

Download
memory/1572-137-0x0000000077940000-0x0000000077A3A000-memory.dmp

Filesize
1000KB

Download
memory/1932-113-0x000000013F930000-0x000000013FA48000-memory.dmp

Filesize
1.1MB

Download
memory/1932-98-0x000000013F930000-0x000000013FA48000-memory.dmp

Filesize
1.1MB

Download
memory/1932-92-0x000007FEFDA40000-0x000007FEFDAAC000-memory.dmp

Filesize
432KB

Download
memory/1932-122-0x000007FEFD6F0000-0x000007FEFD781000-memory.dmp

Filesize
580KB

Download
memory/1932-124-0x000000001BD16000-0x000000001BD35000-memory.dmp

Filesize
124KB

Download
memory/1932-93-0x000007FEFFAC0000-0x000007FEFFB31000-memory.dmp

Filesize
452KB

Download
memory/1932-91-0x0000000077820000-0x000000007793F000-memory.dmp

Filesize
1.1MB

Download
memory/1932-90-0x000007FEFDCF0000-0x000007FEFDD8F000-memory.dmp

Filesize
636KB

Download
memory/1932-127-0x000000013F930000-0x000000013FA48000-memory.dmp

Filesize
1.1MB

Download
memory/1932-89-0x0000000077940000-0x0000000077A3A000-memory.dmp

Filesize
1000KB

Download
memory/1932-88-0x000007FEFE5C0000-0x000007FEFE627000-memory.dmp

Filesize
412KB

Download
memory/1932-87-0x000007FEF7130000-0x000007FEF71CC000-memory.dmp

Filesize
624KB

Download
memory/1932-86-0x000007FEFB780000-0x000007FEFB7EF000-memory.dmp

Filesize
444KB

Download
memory/1932-94-0x000007FEF7030000-0x000007FEF7127000-memory.dmp

Filesize
988KB

Download
memory/1932-95-0x000007FEFDEC0000-0x000007FEFDF9B000-memory.dmp

Filesize
876KB

Download
memory/1932-120-0x000000001BAA0000-0x000000001BAF4000-memory.dmp

Filesize
336KB

Download
memory/1932-99-0x0000000000500000-0x0000000000542000-memory.dmp

Filesize
264KB

Download
memory/1932-96-0x000007FEF61A0000-0x000007FEF6B8C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-100-0x000007FEFDD90000-0x000007FEFDEBD000-memory.dmp

Filesize
1.2MB

Download
memory/1932-101-0x000007FEFFB40000-0x000007FEFFD43000-memory.dmp

Filesize
2.0MB

Download
memory/1932-114-0x0000000000500000-0x0000000000542000-memory.dmp

Filesize
264KB

Download
memory/1932-111-0x000000001B9E0000-0x000000001BA2C000-memory.dmp

Filesize
304KB

Download
memory/1932-110-0x000007FEFE640000-0x000007FEFE717000-memory.dmp

Filesize
860KB

Download
memory/1932-109-0x000007FEFE050000-0x000007FEFE06F000-memory.dmp

Filesize
124KB

Download
memory/1932-108-0x000007FEFD080000-0x000007FEFD097000-memory.dmp

Filesize
92KB

Download
memory/1932-81-0x0000000000000000-mapping.dmp

Download
memory/1932-107-0x000007FEFD1D0000-0x000007FEFD1F2000-memory.dmp

Filesize
136KB

Download
memory/1932-106-0x0000000002090000-0x00000000020DE000-memory.dmp

Filesize
312KB

Download
memory/1932-105-0x0000000002310000-0x00000000023B6000-memory.dmp

Filesize
664KB

Download
memory/1932-104-0x000007FEF6DC0000-0x000007FEF6EEC000-memory.dmp

Filesize
1.2MB

Download
memory/1932-103-0x000000013F930000-0x000000013FA48000-memory.dmp

Filesize
1.1MB

Download
memory/1932-102-0x000007FEFC0E0000-0x000007FEFC136000-memory.dmp

Filesize
344KB

Download