redline | aee569aea573e28a8f1463fcf8adee607449633bc2e16974b3d5e529b84c9d12

Analysis

max time kernel
152s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 318KB
Sample221012-txhpqabdam
SHA256 aee569aea573e28a8f1463fcf8adee607449633bc2e16974b3d5e529b84c9d12
MD5 8e44a1edf30e6d6e43601df83b88a4be
SHA1 c8b783ce19f8a4dd593c60b9ed921e29152dfeb3
SHA512 ee28803ee518054757b3fd55d537bfaac989d5144c73e8daacab978cf1be798911dd81faf68935e5cbebfae8099cffa463db2bdcec3a4e3cada2ecb8f467cdce
SSDEEP 3072:HvGyYiSDnt1Ypr5gBo1YaKAY/gD7b9GHeFtS6:J4GiBoBnb9dFtS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline morn infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Morn

80.66.87.20:80

Attributes

auth_value
98b8a59d3016c72d785854c61b951f1a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3016-153-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4540	SETUP_~1.EXE
800	Hrcwqecjflkxopenfinance_s.exe
3016	SETUP_~1.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Hrcwqecjflkxopenfinance_s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 3016	4540	SETUP_~1.EXE	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1656	powershell.exe
1656	powershell.exe
4876	powershell.exe
4876	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	SETUP_~1.EXE
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	800	Hrcwqecjflkxopenfinance_s.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	3016	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4540	876	file.exe	82
PID 876 wrote to memory of 4540	876	file.exe	82
PID 876 wrote to memory of 4540	876	file.exe	82
PID 4540 wrote to memory of 1656	4540	SETUP_~1.EXE	85
PID 4540 wrote to memory of 1656	4540	SETUP_~1.EXE	85
PID 4540 wrote to memory of 1656	4540	SETUP_~1.EXE	85
PID 4540 wrote to memory of 800	4540	SETUP_~1.EXE	93
PID 4540 wrote to memory of 800	4540	SETUP_~1.EXE	93
PID 4540 wrote to memory of 800	4540	SETUP_~1.EXE	93
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 4540 wrote to memory of 3016	4540	SETUP_~1.EXE	94
PID 800 wrote to memory of 4876	800	Hrcwqecjflkxopenfinance_s.exe	95
PID 800 wrote to memory of 4876	800	Hrcwqecjflkxopenfinance_s.exe	95
PID 800 wrote to memory of 4876	800	Hrcwqecjflkxopenfinance_s.exe	95

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Hrcwqecjflkxopenfinance_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Hrcwqecjflkxopenfinance_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SETUP_~1.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log
Size 1KB
SHA256 5db52f2a6a0fbfaa29e27418a1b72b660298dfa58a12ac0f12897a06e557caef
MD5 4f3fab3e5f44399e7f4162fd367eca2d
SHA1 adada0591db5f53bcc0565942047156de3464e6e
SHA512 d8c3fe3a91e572627e31a44d88a71fc3072786b074d04484ff6aacfeab43e0d29ec88bf6ad2af2a5f8e70f0c0eea95dcea59a8159adf4c642e5f8fd5fc632db7
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 d68cf86114636a4a75f283c54a136e19ddd06706016e0e9664f60f11e3cf3af1
MD5 99b1e0b95264fa7a848ae5ea34be42de
SHA1 7077fd26c522d3f464f7991d333147b591f557b1
SHA512 7c425a0b37c0b55ee734b164be1a84d9be4c2ef4c74047839a3106e45fa0d5a1a2e749e2164c432f20d54b27de5f597103373a6af3ebf397d3644f743a383303
SSDEEP 384:Urf+j/9i+Y6EpY/jjlAFJk8o9o2TVK6seYcI5/r03SoZkfYSPUjE0LiQ:efT68KxAkho2TVNbuYSTRqE0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hrcwqecjflkxopenfinance_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Hrcwqecjflkxopenfinance_s.exe
Size 121KB
SHA256 66fed6c5447cce7c155747c59381d1ff2c68dfa6af63a98930fcbf234d613265
MD5 acbc7d87d612bbc110f5d1012331ce31
SHA1 1542ed53cfd6389caa6b21c780d5b0c2454667d6
SHA512 e36280da388a9fa3502884e4fd7318de18d093382f90ce56e80d5a73d3d2fb6fa6f74a44273d5ab6a819e2c9310be649a438f6e918e8c5abfc8f454cf72de12d
SSDEEP 384:cqr4aLmPyLEL9LkLD/ff6buouKubh9eLgxjlLsnJiJdND3ahxddLhqQsW:cGl9IhosNXytBLsnJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hrcwqecjflkxopenfinance_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Hrcwqecjflkxopenfinance_s.exe
Size 121KB
SHA256 66fed6c5447cce7c155747c59381d1ff2c68dfa6af63a98930fcbf234d613265
MD5 acbc7d87d612bbc110f5d1012331ce31
SHA1 1542ed53cfd6389caa6b21c780d5b0c2454667d6
SHA512 e36280da388a9fa3502884e4fd7318de18d093382f90ce56e80d5a73d3d2fb6fa6f74a44273d5ab6a819e2c9310be649a438f6e918e8c5abfc8f454cf72de12d
SSDEEP 384:cqr4aLmPyLEL9LkLD/ff6buouKubh9eLgxjlLsnJiJdND3ahxddLhqQsW:cGl9IhosNXytBLsnJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.5MB
SHA256 8c3845d1c0a823d28836dd36ab1f19c3f3d8ed859550374f4f9ec877a8c3d72c
MD5 fc590ff21c32ac731b9e24e5c705f12b
SHA1 8e1a7ffdd274c3b793d2488c210fc04771814b47
SHA512 c845593aea0e94245f4353536935fffca75a456fdf08e40221ce9b974e70c9470ebc31c46e701abf977bd66455af3703242726ab26184103b977e33408c3979e
SSDEEP 3072:tyCvmDNJM7tt9jzLxTfQZJ+SmCUz0/dKOVLTsb1Z:Q7VXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.5MB
SHA256 8c3845d1c0a823d28836dd36ab1f19c3f3d8ed859550374f4f9ec877a8c3d72c
MD5 fc590ff21c32ac731b9e24e5c705f12b
SHA1 8e1a7ffdd274c3b793d2488c210fc04771814b47
SHA512 c845593aea0e94245f4353536935fffca75a456fdf08e40221ce9b974e70c9470ebc31c46e701abf977bd66455af3703242726ab26184103b977e33408c3979e
SSDEEP 3072:tyCvmDNJM7tt9jzLxTfQZJ+SmCUz0/dKOVLTsb1Z:Q7VXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.5MB
SHA256 8c3845d1c0a823d28836dd36ab1f19c3f3d8ed859550374f4f9ec877a8c3d72c
MD5 fc590ff21c32ac731b9e24e5c705f12b
SHA1 8e1a7ffdd274c3b793d2488c210fc04771814b47
SHA512 c845593aea0e94245f4353536935fffca75a456fdf08e40221ce9b974e70c9470ebc31c46e701abf977bd66455af3703242726ab26184103b977e33408c3979e
SSDEEP 3072:tyCvmDNJM7tt9jzLxTfQZJ+SmCUz0/dKOVLTsb1Z:Q7VXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/800-151-0x00000000007B0000-0x00000000007D4000-memory.dmp

Download

memory/1656-144-0x0000000006280000-0x00000000062E6000-memory.dmp

Download

memory/1656-145-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/1656-146-0x0000000007F20000-0x000000000859A000-memory.dmp

Download

memory/1656-147-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

Download

memory/1656-143-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/1656-142-0x0000000005A70000-0x0000000006098000-memory.dmp

Download

memory/1656-141-0x00000000032B0000-0x00000000032E6000-memory.dmp

Download

memory/3016-159-0x0000000005020000-0x000000000505C000-memory.dmp

Download

memory/3016-164-0x0000000006760000-0x00000000067D6000-memory.dmp

Download

memory/3016-165-0x00000000067E0000-0x0000000006830000-memory.dmp

Download

memory/3016-153-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3016-156-0x0000000005600000-0x0000000005C18000-memory.dmp

Download

memory/3016-157-0x00000000050F0000-0x00000000051FA000-memory.dmp

Download

memory/3016-158-0x0000000002960000-0x0000000002972000-memory.dmp

Download

memory/4540-138-0x00000000056A0000-0x00000000056AA000-memory.dmp

Download

memory/4540-137-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/4540-136-0x0000000005AE0000-0x0000000006084000-memory.dmp

Download

memory/4540-135-0x0000000000C30000-0x0000000000C4E000-memory.dmp

Download

memory/4540-139-0x0000000008940000-0x0000000008962000-memory.dmp

Download