redline | bc01202df6fc9a64936da157f1c020da3f5bd3ef9e33cec3f84309e2963c5202

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df5c0e79a474d705d3bae534112585fb.exe
Size 2.6MB
Sample221005-e9y5xadfaj
SHA256 bc01202df6fc9a64936da157f1c020da3f5bd3ef9e33cec3f84309e2963c5202
MD5 df5c0e79a474d705d3bae534112585fb
SHA1 8864ba24a1a6b3ebab55bbb41a59f7df4510f6ce
SHA512 037d762e10df319ccc4efc03632260fae0c4602d8f2fa7c79fcba7ce2e9491c20f82729f62e59c2416e8f246b865a0ff8da190638409281000bfb78d2ac8897b
SSDEEP 24576:Uu7ex3hC3Y+YC9p7A6RMvQdZwPocYhW2z63KD2oHILpIfel3RuQ55313K:mx3h8KwWXKD2oHI+2l3U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 5397150605_99 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

5397150605_99

zaraat.xyz:37397

Attributes

auth_value
33dc99eed1e52ba824995bb4fca50b01

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/98676-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/98676-61-0x000000000041B4DE-mapping.dmp	family_redline
behavioral1/memory/98676-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/98676-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
98956	vc_redistx86.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RtkAudUService64.exe	vc_redistx86.exe

Loads dropped DLL 2 IoCs

pid	Process
98676	AppLaunch.exe
98676	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
98676	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	98676	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 1048 wrote to memory of 98676	1048	df5c0e79a474d705d3bae534112585fb.exe	28
PID 98676 wrote to memory of 98956	98676	AppLaunch.exe	30
PID 98676 wrote to memory of 98956	98676	AppLaunch.exe	30
PID 98676 wrote to memory of 98956	98676	AppLaunch.exe	30
PID 98676 wrote to memory of 98956	98676	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\df5c0e79a474d705d3bae534112585fb.exe
"C:\Users\Admin\AppData\Local\Temp\df5c0e79a474d705d3bae534112585fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:98676
- - C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
    "C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    PID:98956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vc_redistx86.exe

Path C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_redistx86.exe

Path C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_redistx86.exe

Path \Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_redistx86.exe

Path \Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/98676-54-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/98676-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/98676-62-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/98676-63-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/98676-64-0x0000000076171000-0x0000000076173000-memory.dmp

Download