redline | 978e91c1a1ab273aecebfa1a686a0110b3431fd1745034814673c86904909b71

Analysis

max time kernel
80s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Installer 2.0.exe
Size

2.6MB
MD5

ec42526811236af065d26632d2b2cbba
SHA1

11a9c8144dafa4b04f76f7a340da9a8c88d8a9a5
SHA256

40b8d2368df2682276c4040a796a2e3197877002cfc36e95e3f929d0e91c9ad4
SHA512

47702d715ee09a3fb4938adff8ddd325dd6368ebd80e56c5d1c8aa7efe10cc307fa43755942098cece6e37ee5644f018d16ac214ad6a1cecc9bb228b72734522
SSDEEP

24576:yntPs6tYHqVDX6+eRaYKYOSfMI6wM2yGpddkJPQRmreCmf6oStu7qLXKiRYL8+Wi:6ZLmqVDNe1xRZCTu7qLXKiRYa4tl3f

Score

10^/10

redline @akkkerman infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@akkkerman

77.73.134.24:80

Attributes

auth_value
0ba115baec822e8fab2188d69bd8b714

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/101864-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 101864	4816	Installer 2.0.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
101864	AppLaunch.exe
101864	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	101864	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 101864	4816	Installer 2.0.exe	84
PID 4816 wrote to memory of 101864	4816	Installer 2.0.exe	84
PID 4816 wrote to memory of 101864	4816	Installer 2.0.exe	84
PID 4816 wrote to memory of 101864	4816	Installer 2.0.exe	84
PID 4816 wrote to memory of 101864	4816	Installer 2.0.exe	84

C:\Users\Admin\AppData\Local\Temp\Installer 2.0.exe
"C:\Users\Admin\AppData\Local\Temp\Installer 2.0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:101864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/101864-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/101864-138-0x00000000061F0000-0x0000000006808000-memory.dmp

Filesize
6.1MB

Download
memory/101864-139-0x0000000007BC0000-0x0000000007CCA000-memory.dmp

Filesize
1.0MB

Download
memory/101864-140-0x0000000007AB0000-0x0000000007AC2000-memory.dmp

Filesize
72KB

Download
memory/101864-141-0x0000000007B10000-0x0000000007B4C000-memory.dmp

Filesize
240KB

Download
memory/101864-142-0x0000000008ED0000-0x0000000009474000-memory.dmp

Filesize
5.6MB

Download
memory/101864-143-0x0000000008A00000-0x0000000008A92000-memory.dmp

Filesize
584KB

Download
memory/101864-144-0x0000000008AA0000-0x0000000008B06000-memory.dmp

Filesize
408KB

Download
memory/101864-145-0x0000000008D90000-0x0000000008E06000-memory.dmp

Filesize
472KB

Download
memory/101864-146-0x0000000008E10000-0x0000000008E60000-memory.dmp

Filesize
320KB

Download
memory/101864-147-0x0000000009650000-0x0000000009812000-memory.dmp

Filesize
1.8MB

Download
memory/101864-148-0x0000000009D50000-0x000000000A27C000-memory.dmp

Filesize
5.2MB

Download