redline | 34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a

Analysis

max time kernel
138s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 215KB
Sample221012-jnn52ache7
SHA256 34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a
MD5 926677dc69319999351c0771c03ca302
SHA1 0d36a4435c234015d7c3207762b08c1924272753
SHA512 3e34fb409fec7dbe39a6f3e19a0db3f97ac944dfa0c0ffecc00d5510285fe99f42ba80cb6a910f834cb7ba47b487329dc1facc168ce970de34a8e2a32c5abe42
SSDEEP 1536:8I47GyTGCwiSnmQUt0LB18rs5gc3H2KrmswOOF+xcYPit0AQ:8vGyYiSDnt18w5X3HrrmsQMxDqqAQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline morn discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Morn

80.66.87.20:80

Attributes

auth_value
98b8a59d3016c72d785854c61b951f1a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1612-155-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
4340	SETUP_~1.EXE
1688	Oqkftdklafxinmircnotlanguage_s.exe
3260	SETUP_~1.EXE
1612	SETUP_~1.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Oqkftdklafxinmircnotlanguage_s.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4340 set thread context of 1612	4340	SETUP_~1.EXE	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2180	powershell.exe
2180	powershell.exe
4340	SETUP_~1.EXE
4340	SETUP_~1.EXE
4432	powershell.exe
4432	powershell.exe
1612	SETUP_~1.EXE
1612	SETUP_~1.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	SETUP_~1.EXE
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	1688	Oqkftdklafxinmircnotlanguage_s.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1612	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4340	5068	file.exe	82
PID 5068 wrote to memory of 4340	5068	file.exe	82
PID 5068 wrote to memory of 4340	5068	file.exe	82
PID 4340 wrote to memory of 2180	4340	SETUP_~1.EXE	92
PID 4340 wrote to memory of 2180	4340	SETUP_~1.EXE	92
PID 4340 wrote to memory of 2180	4340	SETUP_~1.EXE	92
PID 4340 wrote to memory of 1688	4340	SETUP_~1.EXE	94
PID 4340 wrote to memory of 1688	4340	SETUP_~1.EXE	94
PID 4340 wrote to memory of 1688	4340	SETUP_~1.EXE	94
PID 4340 wrote to memory of 3260	4340	SETUP_~1.EXE	95
PID 4340 wrote to memory of 3260	4340	SETUP_~1.EXE	95
PID 4340 wrote to memory of 3260	4340	SETUP_~1.EXE	95
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 4340 wrote to memory of 1612	4340	SETUP_~1.EXE	96
PID 1688 wrote to memory of 4432	1688	Oqkftdklafxinmircnotlanguage_s.exe	97
PID 1688 wrote to memory of 4432	1688	Oqkftdklafxinmircnotlanguage_s.exe	97
PID 1688 wrote to memory of 4432	1688	Oqkftdklafxinmircnotlanguage_s.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Oqkftdklafxinmircnotlanguage_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Oqkftdklafxinmircnotlanguage_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SETUP_~1.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log
Size 1KB
SHA256 5db52f2a6a0fbfaa29e27418a1b72b660298dfa58a12ac0f12897a06e557caef
MD5 4f3fab3e5f44399e7f4162fd367eca2d
SHA1 adada0591db5f53bcc0565942047156de3464e6e
SHA512 d8c3fe3a91e572627e31a44d88a71fc3072786b074d04484ff6aacfeab43e0d29ec88bf6ad2af2a5f8e70f0c0eea95dcea59a8159adf4c642e5f8fd5fc632db7
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 c5f2c434f2c78c227e85e0a59b78e92330ed1a5fdc618a864190e8886e213550
MD5 ba710dac3b875533fa9193d372b91289
SHA1 293bbd093662871308632574750692e620979823
SHA512 70d9b23c5760892766e8f8a8b8197954acd41b463c001909a05797c197bb0bdf331d308f60f5bf327e9244726f6b7d5730a9737e0a393e8977d8b03160555d35
SSDEEP 384:Urf+jv9i+6Q2UfjC6Bjk+o9o0cTfK6seYcI5/r03SoZkfYSPUjE0LiQ:efxQR92jo0cTfNbuYSTRqE0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
MD5 6d08fd7ee7d279585077bff3b77c9cf1
SHA1 09918a40856f17990378fcf280d3ce399d1bbdde
SHA512 9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01
SSDEEP 96:wCuMxH2gn9Qr393iMMQGjHJvVkOoEV35quW/2viMffthpl4WUl4hbFnU:wCNn9Y95MLkOoEVFNviMfftl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
MD5 6d08fd7ee7d279585077bff3b77c9cf1
SHA1 09918a40856f17990378fcf280d3ce399d1bbdde
SHA512 9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01
SSDEEP 96:wCuMxH2gn9Qr393iMMQGjHJvVkOoEV35quW/2viMffthpl4WUl4hbFnU:wCNn9Y95MLkOoEVFNviMfftl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
MD5 6d08fd7ee7d279585077bff3b77c9cf1
SHA1 09918a40856f17990378fcf280d3ce399d1bbdde
SHA512 9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01
SSDEEP 96:wCuMxH2gn9Qr393iMMQGjHJvVkOoEV35quW/2viMffthpl4WUl4hbFnU:wCNn9Y95MLkOoEVFNviMfftl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a
MD5 6d08fd7ee7d279585077bff3b77c9cf1
SHA1 09918a40856f17990378fcf280d3ce399d1bbdde
SHA512 9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01
SSDEEP 96:wCuMxH2gn9Qr393iMMQGjHJvVkOoEV35quW/2viMffthpl4WUl4hbFnU:wCNn9Y95MLkOoEVFNviMfftl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqkftdklafxinmircnotlanguage_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Oqkftdklafxinmircnotlanguage_s.exe
Size 44KB
SHA256 bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7
MD5 caef853daea33a8898555fee1d45e093
SHA1 f32005ded199e821ef77d501f8368a9dcc89c20c
SHA512 b9e37d92c74d9b0677c1c7f8ca2e68fbda5d04b2ca206f6b5401d32073c798a827c6cf449ccecf9c6b58ed15b3ca18b4ba0b5c53c0566ca194affc5eb411a92b
SSDEEP 768:8jYeM17XpwE3sKfkCbJokUP/W1CqpBoa8PP:feW71D6xP/WIquPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqkftdklafxinmircnotlanguage_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Oqkftdklafxinmircnotlanguage_s.exe
Size 44KB
SHA256 bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7
MD5 caef853daea33a8898555fee1d45e093
SHA1 f32005ded199e821ef77d501f8368a9dcc89c20c
SHA512 b9e37d92c74d9b0677c1c7f8ca2e68fbda5d04b2ca206f6b5401d32073c798a827c6cf449ccecf9c6b58ed15b3ca18b4ba0b5c53c0566ca194affc5eb411a92b
SSDEEP 768:8jYeM17XpwE3sKfkCbJokUP/W1CqpBoa8PP:feW71D6xP/WIquPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-159-0x0000000002880000-0x0000000002892000-memory.dmp

Download

memory/1612-168-0x0000000007660000-0x0000000007B8C000-memory.dmp

Download

memory/1612-167-0x0000000006F60000-0x0000000007122000-memory.dmp

Download

memory/1612-166-0x0000000006550000-0x00000000065A0000-memory.dmp

Download

memory/1612-165-0x00000000064D0000-0x0000000006546000-memory.dmp

Download

memory/1612-160-0x0000000004DB0000-0x0000000004DEC000-memory.dmp

Download

memory/1612-158-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

Download

memory/1612-157-0x00000000053D0000-0x00000000059E8000-memory.dmp

Download

memory/1612-155-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1688-151-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/2180-147-0x00000000065F0000-0x000000000660A000-memory.dmp

Download

memory/2180-144-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/2180-141-0x0000000004B20000-0x0000000004B56000-memory.dmp

Download

memory/2180-143-0x00000000051E0000-0x0000000005246000-memory.dmp

Download

memory/2180-145-0x00000000060F0000-0x000000000610E000-memory.dmp

Download

memory/2180-142-0x00000000052C0000-0x00000000058E8000-memory.dmp

Download

memory/2180-146-0x0000000007780000-0x0000000007DFA000-memory.dmp

Download

memory/4340-137-0x0000000005710000-0x00000000057A2000-memory.dmp

Download

memory/4340-136-0x0000000005C20000-0x00000000061C4000-memory.dmp

Download

memory/4340-138-0x0000000005670000-0x000000000567A000-memory.dmp

Download

memory/4340-139-0x0000000008AE0000-0x0000000008B02000-memory.dmp

Download

memory/4340-135-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Download