redline | bc01202df6fc9a64936da157f1c020da3f5bd3ef9e33cec3f84309e2963c5202

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df5c0e79a474d705d3bae534112585fb.exe
Size 2.6MB
Sample221005-e9y5xadfaj
SHA256 bc01202df6fc9a64936da157f1c020da3f5bd3ef9e33cec3f84309e2963c5202
MD5 df5c0e79a474d705d3bae534112585fb
SHA1 8864ba24a1a6b3ebab55bbb41a59f7df4510f6ce
SHA512 037d762e10df319ccc4efc03632260fae0c4602d8f2fa7c79fcba7ce2e9491c20f82729f62e59c2416e8f246b865a0ff8da190638409281000bfb78d2ac8897b
SSDEEP 24576:Uu7ex3hC3Y+YC9p7A6RMvQdZwPocYhW2z63KD2oHILpIfel3RuQ55313K:mx3h8KwWXKD2oHI+2l3U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 5397150605_99 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

5397150605_99

zaraat.xyz:37397

Attributes

auth_value
33dc99eed1e52ba824995bb4fca50b01

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/100544-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
101136	vc_redistx86.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RtkAudUService64.exe	vc_redistx86.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
100544	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100544	AppLaunch.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83
PID 3212 wrote to memory of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83
PID 3212 wrote to memory of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83
PID 3212 wrote to memory of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83
PID 3212 wrote to memory of 100544	3212	df5c0e79a474d705d3bae534112585fb.exe	83
PID 100544 wrote to memory of 101136	100544	AppLaunch.exe	90
PID 100544 wrote to memory of 101136	100544	AppLaunch.exe	90

C:\Users\Admin\AppData\Local\Temp\df5c0e79a474d705d3bae534112585fb.exe
"C:\Users\Admin\AppData\Local\Temp\df5c0e79a474d705d3bae534112585fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:100544
- - C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
    "C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    PID:101136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vc_redistx86.exe

Path C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_redistx86.exe

Path C:\Users\Admin\AppData\Local\Temp\vc_redistx86.exe
Size 2.8MB
SHA256 852df4f4b8edc6c2e555a509570b8a32ade32b8d39c390be29a1bddd52fe66ff
MD5 69111f72d070a50cbf36dc9d2e793b17
SHA1 5df8d07d601a675cd292948eda207d171c9a7b43
SHA512 c110719b5950b48595a26ede11b527afe688f3e459958aebcf65184c7d7646278069d8d91a931a896893645ba74dee8e2398fe170198e1df7adaa7a8e72ae851
SSDEEP 49152:x1FWItb3srb/T5vO90d7HjmAFd4A64nsfJa4Rq/md6Nq95EWng/v4hot4vZVHB1:X3z+vMExBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/100544-144-0x0000000006390000-0x0000000006422000-memory.dmp

Download

memory/100544-145-0x0000000006430000-0x00000000064A6000-memory.dmp

Download

memory/100544-140-0x0000000005540000-0x000000000564A000-memory.dmp

Download

memory/100544-141-0x0000000005470000-0x00000000054AC000-memory.dmp

Download

memory/100544-142-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/100544-143-0x0000000006860000-0x0000000006E04000-memory.dmp

Download

memory/100544-139-0x0000000001610000-0x0000000001622000-memory.dmp

Download

memory/100544-146-0x0000000006650000-0x000000000666E000-memory.dmp

Download

memory/100544-147-0x0000000006FE0000-0x00000000071A2000-memory.dmp

Download

memory/100544-148-0x00000000076E0000-0x0000000007C0C000-memory.dmp

Download

memory/100544-149-0x0000000007470000-0x00000000074C0000-memory.dmp

Download

memory/100544-133-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/100544-138-0x0000000005A50000-0x0000000006068000-memory.dmp

Download