redline | 978e91c1a1ab273aecebfa1a686a0110b3431fd1745034814673c86904909b71

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/09/2022, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Installer 2.0.exe
Size

2.6MB
MD5

ec42526811236af065d26632d2b2cbba
SHA1

11a9c8144dafa4b04f76f7a340da9a8c88d8a9a5
SHA256

40b8d2368df2682276c4040a796a2e3197877002cfc36e95e3f929d0e91c9ad4
SHA512

47702d715ee09a3fb4938adff8ddd325dd6368ebd80e56c5d1c8aa7efe10cc307fa43755942098cece6e37ee5644f018d16ac214ad6a1cecc9bb228b72734522
SSDEEP

24576:yntPs6tYHqVDX6+eRaYKYOSfMI6wM2yGpddkJPQRmreCmf6oStu7qLXKiRYL8+Wi:6ZLmqVDNe1xRZCTu7qLXKiRYa4tl3f

Score

10^/10

redline @akkkerman infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@akkkerman

77.73.134.24:80

Attributes

auth_value
0ba115baec822e8fab2188d69bd8b714

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/95528-57-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/95528-62-0x00000000004221E2-mapping.dmp	family_redline
behavioral1/memory/95528-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/95528-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 95528	1948	Installer 2.0.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
95528	AppLaunch.exe
95528	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	95528	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29
PID 1948 wrote to memory of 95528	1948	Installer 2.0.exe	29

C:\Users\Admin\AppData\Local\Temp\Installer 2.0.exe
"C:\Users\Admin\AppData\Local\Temp\Installer 2.0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:95528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/95528-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95528-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95528-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95528-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download