redline | 831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe
Size 1.7MB
Sample221017-he8mmsahd2
SHA256 831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955
MD5 b96d58997d06c053bf56ba46ab1fd020
SHA1 9d0d0dab5a1e1771c47267fd2e8b30afb288e34d
SHA512 771179660a2ca299e74baaa3b4ef988838875bd5ac6dbf156cf38a2d79d264d924e8c0431a91dd13efe16cd0cd05b6d0b7878808d531c1f1d14e1d6850c7d5d7
SSDEEP 24576:2sRsFiCCER6pIA94JzHelAZ0THlErx0plbaK5x/kxChx4:fsFiC9R7vB+lAK2r2vuK4xChx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline me infostealer

Malware Config

Extracted

Family

redline

Botnet

92.119.112.239:22628

Attributes

auth_value
0b41ed1bdf04c7505d47398771081370

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4648-143-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	powershell.exe
5072	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 5072	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	85
PID 1884 wrote to memory of 5072	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	85
PID 1884 wrote to memory of 5072	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	85
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91
PID 1884 wrote to memory of 4648	1884	831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe	91

C:\Users\Admin\AppData\Local\Temp\831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe
"C:\Users\Admin\AppData\Local\Temp\831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe
  C:\Users\Admin\AppData\Local\Temp\831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe
  2⤵
  PID:4648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\831ba9e459ac368dad8e2a9136fcef1663cf68e32aa660283238215f0f3d4955.exe.log
Size 1KB
SHA256 5ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
MD5 7e88081fcf716d85992bb3af3d9b6454
SHA1 2153780fbc71061b0102a7a7b665349e1013e250
SHA512 ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
MD5 SHA1 SHA512

Submit Download

memory/1884-133-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/1884-132-0x0000000000210000-0x00000000003CA000-memory.dmp

Download

memory/4648-148-0x0000000007CB0000-0x0000000007CEC000-memory.dmp

Download

memory/4648-147-0x0000000007C50000-0x0000000007C62000-memory.dmp

Download

memory/4648-146-0x0000000007D40000-0x0000000007E4A000-memory.dmp

Download

memory/4648-145-0x00000000063B0000-0x00000000069C8000-memory.dmp

Download

memory/4648-143-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5072-136-0x00000000052C0000-0x00000000058E8000-memory.dmp

Download

memory/5072-141-0x00000000064E0000-0x00000000064FA000-memory.dmp

Download

memory/5072-140-0x0000000007620000-0x0000000007C9A000-memory.dmp

Download

memory/5072-139-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

Download

memory/5072-138-0x0000000005250000-0x00000000052B6000-memory.dmp

Download

memory/5072-137-0x00000000051E0000-0x0000000005246000-memory.dmp

Download

memory/5072-135-0x0000000002A10000-0x0000000002A46000-memory.dmp

Download