redline | 3313e6d16aabacfe4f6891408f9e8d3d9005d885e5bd0e8349c2a3dbe9352017

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 200KB
Sample221005-vwer4sfab2
SHA256 3313e6d16aabacfe4f6891408f9e8d3d9005d885e5bd0e8349c2a3dbe9352017
MD5 3b64d7c84a343daf29c70331e454affe
SHA1 a6a882396f52d1697337356562cf7813be697e7a
SHA512 fb9835a943b065c9f14af6b8812ec021626faa19672b512a418303c2472ba9450838d66f7a40062a94115a4d1dcd1d6ce42679fb235f8ee58edb94b37b01ca6a
SSDEEP 1536:PI47GyTGCwiSnmQUt0LB1XUxs5gHxeBp59y/A6/:PvGyYiSDnt1Ee5cxeBpTxg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline smokeloader duk backdoor discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

yaterirennin.xyz:80
ncoduryllixe.xyz:80

Attributes

auth_value
4fcab551b8507f2194546356260086e4

Signatures

Detects Smokeloader packer 3 IoCs

resource	yara_rule
behavioral2/memory/628-168-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral2/memory/628-170-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral2/memory/628-171-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4424-150-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
1488	SETUP_~1.EXE
3108	Vgvmwqbanhysoldierspend_s.exe
4424	SETUP_~1.EXE
628	Vgvmwqbanhysoldierspend_s.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Vgvmwqbanhysoldierspend_s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 4424	1488	SETUP_~1.EXE	95
PID 3108 set thread context of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Vgvmwqbanhysoldierspend_s.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Vgvmwqbanhysoldierspend_s.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Vgvmwqbanhysoldierspend_s.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4172	powershell.exe
4172	powershell.exe
4036	powershell.exe
4036	powershell.exe
4424	SETUP_~1.EXE
4424	SETUP_~1.EXE
628	Vgvmwqbanhysoldierspend_s.exe
628	Vgvmwqbanhysoldierspend_s.exe
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found
760	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
628	Vgvmwqbanhysoldierspend_s.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	SETUP_~1.EXE
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	3108	Vgvmwqbanhysoldierspend_s.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4424	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1488	1388	file.exe	84
PID 1388 wrote to memory of 1488	1388	file.exe	84
PID 1388 wrote to memory of 1488	1388	file.exe	84
PID 1488 wrote to memory of 4172	1488	SETUP_~1.EXE	88
PID 1488 wrote to memory of 4172	1488	SETUP_~1.EXE	88
PID 1488 wrote to memory of 4172	1488	SETUP_~1.EXE	88
PID 1488 wrote to memory of 3108	1488	SETUP_~1.EXE	94
PID 1488 wrote to memory of 3108	1488	SETUP_~1.EXE	94
PID 1488 wrote to memory of 3108	1488	SETUP_~1.EXE	94
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 1488 wrote to memory of 4424	1488	SETUP_~1.EXE	95
PID 3108 wrote to memory of 4036	3108	Vgvmwqbanhysoldierspend_s.exe	96
PID 3108 wrote to memory of 4036	3108	Vgvmwqbanhysoldierspend_s.exe	96
PID 3108 wrote to memory of 4036	3108	Vgvmwqbanhysoldierspend_s.exe	96
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98
PID 3108 wrote to memory of 628	3108	Vgvmwqbanhysoldierspend_s.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA2AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
      C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SETUP_~1.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log
Size 1KB
SHA256 0aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
MD5 e87e48b105757e1c7563d1c719059733
SHA1 28a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA512 bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 5145f658c57f45c7442c7d1f5f1bbe643f250931a106800551393f08356bb5b8
MD5 fe554b3a855427875b9e6c2320574156
SHA1 b56390f02e237a116a8209b35218bc6b193c51c6
SHA512 dca6249bf0e3eae5a2fcc7d51d384bc2f6cae467fc5e7191cc3bf811afdf2c74d67bbd71d90a1043e693c08a795e26fb9b92bdd5bc6a6ad9f32d743cdc929f22
SSDEEP 384:xj+jv9i+BWVk/yZB0izJk+o9o2T5K6seYZIh/r03SoZUfYSPAjE0LCQ:FX2eBDejo2T5NyeYSjR+E03
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 71f130733443d459bcdc86e8338fbbd1a50426e279fbaaae2e3fb97862c18b20
MD5 15d17cbe1341af9e0de2dd16b90b2947
SHA1 4ebb8ff36f8871eed4aee42f52df95ab4506700c
SHA512 ec00868112af74006e6bfc835fe005b8aa43e40a46a142c2afd71c98136274e5a43f311ed1d5c913c66cfd6fde76a4e631176414a48e8e55e96ca5817514e776
SSDEEP 192:cjck4JfO6lJV0KelQ2vNLuD/0eTkYvgjrSGI8wNQ+Y1pEZGGeq335Bbxr:cjgffjeFl9lLuD/0erGqbZDH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 71f130733443d459bcdc86e8338fbbd1a50426e279fbaaae2e3fb97862c18b20
MD5 15d17cbe1341af9e0de2dd16b90b2947
SHA1 4ebb8ff36f8871eed4aee42f52df95ab4506700c
SHA512 ec00868112af74006e6bfc835fe005b8aa43e40a46a142c2afd71c98136274e5a43f311ed1d5c913c66cfd6fde76a4e631176414a48e8e55e96ca5817514e776
SSDEEP 192:cjck4JfO6lJV0KelQ2vNLuD/0eTkYvgjrSGI8wNQ+Y1pEZGGeq335Bbxr:cjgffjeFl9lLuD/0erGqbZDH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 71f130733443d459bcdc86e8338fbbd1a50426e279fbaaae2e3fb97862c18b20
MD5 15d17cbe1341af9e0de2dd16b90b2947
SHA1 4ebb8ff36f8871eed4aee42f52df95ab4506700c
SHA512 ec00868112af74006e6bfc835fe005b8aa43e40a46a142c2afd71c98136274e5a43f311ed1d5c913c66cfd6fde76a4e631176414a48e8e55e96ca5817514e776
SSDEEP 192:cjck4JfO6lJV0KelQ2vNLuD/0eTkYvgjrSGI8wNQ+Y1pEZGGeq335Bbxr:cjgffjeFl9lLuD/0erGqbZDH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vgvmwqbanhysoldierspend_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
Size 104KB
SHA256 cedb075b56bfa4bf627f3062128fb8dcd7ab774dab0b5b652f0a31e5c22297ac
MD5 2c68d90e52d24dc09ab5fd15c4ee6b76
SHA1 90535189fa5a571744b0010d30019e5a759931c6
SHA512 bc11b1fb3bc4233f6a2dfcb565b9fcf7cfe48f8b46f80acf615bbed2afff78e1d4ce07aa3dbec0f08a82456a9410b8af7f0b035c56333a87e74cd572bdac8c52
SSDEEP 1536:c7TD5uYDRU8mLSHJLLXLLXLLXLLmXXXT5t:c7TtuYtU8mpXXXtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vgvmwqbanhysoldierspend_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
Size 104KB
SHA256 cedb075b56bfa4bf627f3062128fb8dcd7ab774dab0b5b652f0a31e5c22297ac
MD5 2c68d90e52d24dc09ab5fd15c4ee6b76
SHA1 90535189fa5a571744b0010d30019e5a759931c6
SHA512 bc11b1fb3bc4233f6a2dfcb565b9fcf7cfe48f8b46f80acf615bbed2afff78e1d4ce07aa3dbec0f08a82456a9410b8af7f0b035c56333a87e74cd572bdac8c52
SSDEEP 1536:c7TD5uYDRU8mLSHJLLXLLXLLXLLmXXXT5t:c7TtuYtU8mpXXXtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vgvmwqbanhysoldierspend_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Vgvmwqbanhysoldierspend_s.exe
Size 104KB
SHA256 cedb075b56bfa4bf627f3062128fb8dcd7ab774dab0b5b652f0a31e5c22297ac
MD5 2c68d90e52d24dc09ab5fd15c4ee6b76
SHA1 90535189fa5a571744b0010d30019e5a759931c6
SHA512 bc11b1fb3bc4233f6a2dfcb565b9fcf7cfe48f8b46f80acf615bbed2afff78e1d4ce07aa3dbec0f08a82456a9410b8af7f0b035c56333a87e74cd572bdac8c52
SSDEEP 1536:c7TD5uYDRU8mLSHJLLXLLXLLXLLmXXXT5t:c7TtuYtU8mpXXXtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-171-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/628-168-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/628-170-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1488-136-0x0000000006B50000-0x0000000006B72000-memory.dmp

Download

memory/1488-135-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Download

memory/3108-148-0x0000000000440000-0x0000000000460000-memory.dmp

Download

memory/4172-142-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/4172-143-0x0000000007EB0000-0x000000000852A000-memory.dmp

Download

memory/4172-138-0x00000000052C0000-0x00000000052F6000-memory.dmp

Download

memory/4172-139-0x0000000005A00000-0x0000000006028000-memory.dmp

Download

memory/4172-140-0x00000000061A0000-0x0000000006206000-memory.dmp

Download

memory/4172-141-0x0000000006280000-0x00000000062E6000-memory.dmp

Download

memory/4172-144-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Download

memory/4424-161-0x0000000007400000-0x00000000079A4000-memory.dmp

Download

memory/4424-153-0x0000000005D90000-0x00000000063A8000-memory.dmp

Download

memory/4424-162-0x0000000006F60000-0x0000000006FF2000-memory.dmp

Download

memory/4424-163-0x00000000079B0000-0x0000000007B72000-memory.dmp

Download

memory/4424-164-0x00000000080B0000-0x00000000085DC000-memory.dmp

Download

memory/4424-165-0x0000000007B80000-0x0000000007BF6000-memory.dmp

Download

memory/4424-166-0x00000000073B0000-0x0000000007400000-memory.dmp

Download

memory/4424-150-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4424-156-0x00000000058A0000-0x00000000058DC000-memory.dmp

Download

memory/4424-155-0x0000000005840000-0x0000000005852000-memory.dmp

Download

memory/4424-154-0x0000000005910000-0x0000000005A1A000-memory.dmp

Download