redline | 464dcd506637588f1640550f411af1a56a1d9784e61e43e9bcf247b3243211e8

Analysis

max time kernel
45s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

455KB
MD5

7da4f28ff1f32712b6e1040ca084f15a
SHA1

24780c059523125cf643cd17ef4e86d0907ecad0
SHA256

464dcd506637588f1640550f411af1a56a1d9784e61e43e9bcf247b3243211e8
SHA512

cf85cd8562c1e2ce8fe08542a6cb0a70b7e7ca5b5ace4de709b93ffac9fda5366d59c7f39d6887f8ce583d26c107b95c4b29fc85dbf5523261ca6a2601d6412d
SSDEEP

6144:3EQjpzNsFX8NxTCQBppX8fRqUqudKr48GASVb/53qDxEw7gn5UkgPaMAOJCgO4o:3TkOjpsfcUqudKmuH7gSkbMDCHl

Score

10^/10

redline 5497250084 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

5497250084

79.137.192.6:8362

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/99104-56-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline
behavioral1/memory/99104-61-0x00000000000A972E-mapping.dmp	family_redline
behavioral1/memory/99104-62-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline
behavioral1/memory/99104-63-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
99176	Webintonet.exe

Loads dropped DLL 7 IoCs

pid	Process
99104	AppLaunch.exe
99104	AppLaunch.exe
99404	WerFault.exe
99404	WerFault.exe
99404	WerFault.exe
99404	WerFault.exe
99404	WerFault.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 99104	1672	file.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
99152	1672	WerFault.exe	26
99404	99176	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
99104	AppLaunch.exe
99104	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	99104	AppLaunch.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99104	1672	file.exe	28
PID 1672 wrote to memory of 99152	1672	file.exe	30
PID 1672 wrote to memory of 99152	1672	file.exe	30
PID 1672 wrote to memory of 99152	1672	file.exe	30
PID 1672 wrote to memory of 99152	1672	file.exe	30
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99104 wrote to memory of 99176	99104	AppLaunch.exe	32
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34
PID 99176 wrote to memory of 99404	99176	Webintonet.exe	34

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:99104
- - C:\Users\Admin\AppData\Local\Temp\Webintonet.exe
    "C:\Users\Admin\AppData\Local\Temp\Webintonet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:99176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 99176 -s 648
      4⤵
      Loads dropped DLL
      Program crash
      PID:99404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 97752
  2⤵
  - Program crash
  PID:99152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
\Users\Admin\AppData\Local\Temp\Webintonet.exe

Filesize
1008KB

MD5
22091d3370dafe52ef6450c6ff3ff48b

SHA1
e5e9be3c1ce78eba676ea17d2a93aebd91ceefe6

SHA256
472dab7169b270aa614e19284836cf60e8ca7e5b4b0d95d33b356c253842e655

SHA512
4f1e573098e47600d5a3883caedf31f6fbe4956a90ab306c878547fa0eb824faa7db8d8f6b80b5af6140286c4064710688cbee22fffb6bbf5083b0c8987474e3

Download Submit
memory/99104-63-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/99104-62-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/99104-54-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/99104-64-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/99104-61-0x00000000000A972E-mapping.dmp

Download
memory/99104-56-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/99152-65-0x0000000000000000-mapping.dmp

Download
memory/99176-72-0x0000000001350000-0x0000000001452000-memory.dmp

Filesize
1.0MB

Download
memory/99176-73-0x0000000000720000-0x0000000000802000-memory.dmp

Filesize
904KB

Download
memory/99176-68-0x0000000000000000-mapping.dmp

Download
memory/99404-74-0x0000000000000000-mapping.dmp

Download