redline | 8fd2ebffd41f9ec41fda3747c1a81cf910ab70650e0dc39f78644a3b2f0d6670

Analysis

max time kernel
151s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2022, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 421KB
Sample221022-h13nhsbfbj
SHA256 8fd2ebffd41f9ec41fda3747c1a81cf910ab70650e0dc39f78644a3b2f0d6670
MD5 c48f708e3b9597e75ec5830a154c522a
SHA1 fb0572306e1c540731dc3d1e66e2fa1f32e38a21
SHA512 883500e000a5668dd7bc14bde0800eb310671945087018dd197cdb61132838ac85aeacdda69f239c50dd166dd710f528cefd2af43fd3d8ec31e1cfcf7310984d
SSDEEP 1536:Brae78zjORCDGwfdCSog01313dXs5gl9cOh1CXt/cN45Hth/YVj60UJg/3Lx2R7g:nahKyd2n31N85yz1CXqN29W2pLaDo2r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline morn discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Morn

89.208.106.66:4691

Attributes

auth_value
c5df9909d595d1c2590335eb40f0e743

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/884-150-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2892	SETUP_~1.EXE
1596	Ktaxrajmvgkmarriageprocess_s.exe
884	SETUP_~1.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Ktaxrajmvgkmarriageprocess_s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 884	2892	SETUP_~1.EXE	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1284	powershell.exe
1284	powershell.exe
4188	powershell.exe
4188	powershell.exe
884	SETUP_~1.EXE
884	SETUP_~1.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	SETUP_~1.EXE
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	1596	Ktaxrajmvgkmarriageprocess_s.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	884	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2892	4972	file.exe	82
PID 4972 wrote to memory of 2892	4972	file.exe	82
PID 4972 wrote to memory of 2892	4972	file.exe	82
PID 2892 wrote to memory of 1284	2892	SETUP_~1.EXE	86
PID 2892 wrote to memory of 1284	2892	SETUP_~1.EXE	86
PID 2892 wrote to memory of 1284	2892	SETUP_~1.EXE	86
PID 2892 wrote to memory of 1596	2892	SETUP_~1.EXE	91
PID 2892 wrote to memory of 1596	2892	SETUP_~1.EXE	91
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 2892 wrote to memory of 884	2892	SETUP_~1.EXE	92
PID 1596 wrote to memory of 4188	1596	Ktaxrajmvgkmarriageprocess_s.exe	93
PID 1596 wrote to memory of 4188	1596	Ktaxrajmvgkmarriageprocess_s.exe	93

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Ktaxrajmvgkmarriageprocess_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Ktaxrajmvgkmarriageprocess_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SETUP_~1.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log
Size 1KB
SHA256 0aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
MD5 e87e48b105757e1c7563d1c719059733
SHA1 28a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA512 bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 56KB
SHA256 b61dddc9c2b6c3dd1c1e24c9ada63e1207c4008b545413413261174427eef7a3
MD5 2cde87bce6680d1b4f30c00e2af18416
SHA1 722b6517af0a702e1a79dceea14d7c6df1a4eb78
SHA512 bedac39ea6b6e89489865b22707f771af4c53c29a396be0f819782818095f76a6040fa70d6d0db2a33340b8908ea286a949ed4d71c1d6aaf8de43018017b7829
SSDEEP 1536:k5C+jH04tAHkCSMrxyNhftflJdGYoFi3j39MVvjMlUstzyhNOwUp7bNvv+EGa5bp:wC+jH04tAHk5MrxyNhftflJdGYoFi3j5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 41e8c6bc1cf00246a6477b5b69a6a6f8fb53071c3329b40b28883ef9869e6a91
MD5 c76056cf74654b7684944143e3c6374c
SHA1 b816db9d7347f6b02cfccea444f63c89efba7258
SHA512 681cae9adeb34084321ee65152989178f737d4b42b67dba66e10c1c77ddfca19d8f58000851a7f3cdad9afc1b610f1396c98153dedb335ee0c5ea44cbc86fd1e
SSDEEP 384:xrf+j/9i+42SZeuOIBUuzRkkbo9o2T5K6seYcIh/r03SoZUfYSPAjE0LCQ:Zfv2SMrIjNHMo2T5NbeYSjR+E03
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 214.6MB
SHA256 f4b6a0f57844bb74338313e5db973ece798ab4b8beba5e46dd41622bb9c237fa
MD5 e4d2a972640b23238964351d14a0950e
SHA1 2dee4b5fa23739580ef9ccc6bac06468979557df
SHA512 9732a67f500f4e10d2b3b3e669c44236e4568a36ce58c9b17d4a70524624f199c7e461763035e2872ac538e6486db691c5707afc26723a65715652a1aeef4b32
SSDEEP 96:aetZFJrkUeoz+Eiv7gfm4ooiRJoiTFnU:aejjeozs7gfc1Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 214.6MB
SHA256 f4b6a0f57844bb74338313e5db973ece798ab4b8beba5e46dd41622bb9c237fa
MD5 e4d2a972640b23238964351d14a0950e
SHA1 2dee4b5fa23739580ef9ccc6bac06468979557df
SHA512 9732a67f500f4e10d2b3b3e669c44236e4568a36ce58c9b17d4a70524624f199c7e461763035e2872ac538e6486db691c5707afc26723a65715652a1aeef4b32
SSDEEP 96:aetZFJrkUeoz+Eiv7gfm4ooiRJoiTFnU:aejjeozs7gfc1Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 157.8MB
SHA256 d34884523d46998a2e8df410d778776b2f427e739ea7ac78abc11b25b9bbe548
MD5 edfa65fea110327a39a2abfe70a4f887
SHA1 cb5d1f820a79f4bc295c2935f260bd90268a3347
SHA512 0e044de80b8649121bc2004d29b92ad09f700b0af1203940e8f3d6d9f50b9db4cd3006975c34e6cbacd54013653b91e3208cd07a1d34c262eee1152afffc5f49
SSDEEP 96:aetZFJrkUeoz+Eiv7gfm4ooiRJoiTFnU:aejjeozs7gfc1Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ktaxrajmvgkmarriageprocess_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Ktaxrajmvgkmarriageprocess_s.exe
Size 5KB
SHA256 131685ad9bb9b4f9b48e9d59041ce51aa48c974a1f0b8aa44c8746b94559b2e9
MD5 bd4d75e59b21dff623473ddecdabe141
SHA1 e80190a71bf8d32731e51c5621e525e7a5840b72
SHA512 86fd01266f0c6c9fb198d0d0b31350b57bc8b0f8d0e6270f39c18523237efd5c0c4ebd727227a195830f7db9b0085610b2cfc0a68b458fcc2016bd6d52ebfaf2
SSDEEP 96:45qoNAojFyYVpq+et/KPsRj4ooDJoVFnUq:VohyYVpqHyPsRxqJzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ktaxrajmvgkmarriageprocess_s.exe

Path C:\Users\Admin\AppData\Local\Temp\Ktaxrajmvgkmarriageprocess_s.exe
Size 5KB
SHA256 131685ad9bb9b4f9b48e9d59041ce51aa48c974a1f0b8aa44c8746b94559b2e9
MD5 bd4d75e59b21dff623473ddecdabe141
SHA1 e80190a71bf8d32731e51c5621e525e7a5840b72
SHA512 86fd01266f0c6c9fb198d0d0b31350b57bc8b0f8d0e6270f39c18523237efd5c0c4ebd727227a195830f7db9b0085610b2cfc0a68b458fcc2016bd6d52ebfaf2
SSDEEP 96:45qoNAojFyYVpq+et/KPsRj4ooDJoVFnUq:VohyYVpqHyPsRxqJzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/884-167-0x0000000006D50000-0x0000000006DC6000-memory.dmp

Download

memory/884-158-0x00000000056E0000-0x000000000571C000-memory.dmp

Download

memory/884-157-0x0000000005680000-0x0000000005692000-memory.dmp

Download

memory/884-156-0x0000000005750000-0x000000000585A000-memory.dmp

Download

memory/884-155-0x0000000005BD0000-0x00000000061E8000-memory.dmp

Download

memory/884-164-0x0000000005A80000-0x0000000005B12000-memory.dmp

Download

memory/884-165-0x00000000067A0000-0x0000000006D44000-memory.dmp

Download

memory/884-150-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/884-168-0x0000000006DD0000-0x0000000006E20000-memory.dmp

Download

memory/1284-141-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/1284-140-0x0000000004DD0000-0x0000000004E36000-memory.dmp

Download

memory/1284-138-0x0000000002710000-0x0000000002746000-memory.dmp

Download

memory/1284-139-0x0000000004F70000-0x0000000005598000-memory.dmp

Download

memory/1284-144-0x00000000060E0000-0x00000000060FA000-memory.dmp

Download

memory/1284-143-0x0000000007390000-0x0000000007A0A000-memory.dmp

Download

memory/1284-142-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Download

memory/1596-163-0x00007FFD88D10000-0x00007FFD897D1000-memory.dmp

Download

memory/1596-154-0x00000000015F0000-0x0000000001612000-memory.dmp

Download

memory/1596-148-0x0000000000F20000-0x0000000000F26000-memory.dmp

Download

memory/1596-153-0x00007FFD88D10000-0x00007FFD897D1000-memory.dmp

Download

memory/2892-136-0x0000000007650000-0x0000000007672000-memory.dmp

Download

memory/2892-135-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

Download

memory/4188-161-0x00007FFD88D10000-0x00007FFD897D1000-memory.dmp

Download

memory/4188-166-0x00007FFD88D10000-0x00007FFD897D1000-memory.dmp

Download