redline | 816636033881f5932f282b68e3fda7515b85b53d3507fa4c9a2c10323a2b3130

Analysis

max time kernel
143s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9eaa93e3364ec0aa8030c3a800e9b7e6.exe
Size 2.4MB
Sample221102-nnad4abeb5
SHA256 816636033881f5932f282b68e3fda7515b85b53d3507fa4c9a2c10323a2b3130
MD5 9eaa93e3364ec0aa8030c3a800e9b7e6
SHA1 1e09593e7f0e68e411223d46809bbed7bbfc4aff
SHA512 7f70d40b48d59432235435ea38f9cdf968422a65999be3ac2470aa91737cd324c7486caac9ad0b7ba2eafd3428bb62e3a2ab9f3eeb94fecc4e755f8f3119f931
SSDEEP 24576:qKcDiCZEY7YEu4sn2M1tTQaPjcy78j/XwHyUgKyOmU2LfHHjxHhpcjl3RuQ5531X:qKYiCXjbXGyUgvOmU2Sjl3x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @realc4ps3r infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

@REALC4PS3R

82.115.223.162:26393

Attributes

auth_value
3a12f66f652143b72c9a6d22a22719c8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/1684-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1684-61-0x000000000042229E-mapping.dmp	family_redline
behavioral1/memory/1684-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1684-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1780	Ubisoft.exe
1912	Ubisoft.exe
788	Decoder.exe

Loads dropped DLL 2 IoCs

pid	Process
1684	vbc.exe
1780	Ubisoft.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Thyzblmtm = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mbirag\\Thyzblmtm.exe\""	Ubisoft.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Ubisoft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Ubisoft.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1780 set thread context of 1912	1780	Ubisoft.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
788	Decoder.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1684	vbc.exe
1684	vbc.exe
1508	powershell.exe
1780	Ubisoft.exe
1780	Ubisoft.exe
1780	Ubisoft.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	vbc.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1780	Ubisoft.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1960 wrote to memory of 1684	1960	9eaa93e3364ec0aa8030c3a800e9b7e6.exe	29
PID 1684 wrote to memory of 1780	1684	vbc.exe	31
PID 1684 wrote to memory of 1780	1684	vbc.exe	31
PID 1684 wrote to memory of 1780	1684	vbc.exe	31
PID 1684 wrote to memory of 1780	1684	vbc.exe	31
PID 1780 wrote to memory of 1508	1780	Ubisoft.exe	32
PID 1780 wrote to memory of 1508	1780	Ubisoft.exe	32
PID 1780 wrote to memory of 1508	1780	Ubisoft.exe	32
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1780 wrote to memory of 1912	1780	Ubisoft.exe	35
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36
PID 1912 wrote to memory of 788	1912	Ubisoft.exe	36

C:\Users\Admin\AppData\Local\Temp\9eaa93e3364ec0aa8030c3a800e9b7e6.exe
"C:\Users\Admin\AppData\Local\Temp\9eaa93e3364ec0aa8030c3a800e9b7e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
    "C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
      C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Decoder.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Decoder.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Decoder.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Decoder.exe
Size 73.0MB
SHA256 bd905d76fcdb76326d64a4008dd331179099b3a6c350b31ea1c194b53cbc87d0
MD5 6e13417615f3f7e8d54c00e955cf6609
SHA1 14561cf0f9a2579eb5ebee8eee52f44010bff3c8
SHA512 cbfc88e7b9193f407feb50768bf0083c87c88d039ebcfd5d2297b2936eaffb7f3f32b51fe94e1db97884791dffc1a96ccec200bed5532d9101c4d0f4d263a2b0
SSDEEP 12288:M79v4fvwfZltn1f8Sv5MpvDmrMwqPNtjPZ2j9CSiyla:M79v4fv61ffvsvKqPNt960lyla
MD5 SHA1 SHA512 SSDEEP

Submit Download

Decoder.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Decoder.exe
Size 73.5MB
SHA256 d3a79dbba75c22d9a6a5f69bfe693e2e1479fbb2e95ce51f7b466a457027229c
MD5 f30c6ef9e1ed2c0bb5a295a864e89753
SHA1 40bccc98c0cf6abbc7f6c3578569ea7606b6e398
SHA512 480af5fdd2628cc62ad1890615bd2fee77888b238f09d760d5628a15ff4ce4cde591dce87391d0efda2ae236d9394c0b21be082ed4707afed554c926858c538c
SSDEEP 12288:M79v4fvwfZltn1f8Sv5MpvDmrMwqPNtjPZ2j9CSiyla:M79v4fv61ffvsvKqPNt960lyla
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubisoft.exe

Path C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
Size 1.5MB
SHA256 35934fa08336d8dd4a47f495a9a39a2b055e45e0ffa6058d375bfb562f9c87c2
MD5 49ea5876ebd50e9dc4abf82075543af3
SHA1 738f86ae40a01e6abcfd687e680ec42c96882caa
SHA512 1119dde5c345e6ef9cba5bd52ec97a4297e7ed7516c8a17f7683683bb68d4a4622ccb5952453c1d78fb61dbb21dc8896c8aba4934256e8434eedf2b8ad8f08e7
SSDEEP 24576:wRsP7pqUqbVQWD0bFc9+jPP07LV/GFfZ8O+bWMcUBLb1:xqUQCbDjPPaLVO0O+b/9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubisoft.exe

Path C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
Size 1.5MB
SHA256 35934fa08336d8dd4a47f495a9a39a2b055e45e0ffa6058d375bfb562f9c87c2
MD5 49ea5876ebd50e9dc4abf82075543af3
SHA1 738f86ae40a01e6abcfd687e680ec42c96882caa
SHA512 1119dde5c345e6ef9cba5bd52ec97a4297e7ed7516c8a17f7683683bb68d4a4622ccb5952453c1d78fb61dbb21dc8896c8aba4934256e8434eedf2b8ad8f08e7
SSDEEP 24576:wRsP7pqUqbVQWD0bFc9+jPP07LV/GFfZ8O+bWMcUBLb1:xqUQCbDjPPaLVO0O+b/9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubisoft.exe

Path C:\Users\Admin\AppData\Local\Temp\Ubisoft.exe
Size 1.5MB
SHA256 35934fa08336d8dd4a47f495a9a39a2b055e45e0ffa6058d375bfb562f9c87c2
MD5 49ea5876ebd50e9dc4abf82075543af3
SHA1 738f86ae40a01e6abcfd687e680ec42c96882caa
SHA512 1119dde5c345e6ef9cba5bd52ec97a4297e7ed7516c8a17f7683683bb68d4a4622ccb5952453c1d78fb61dbb21dc8896c8aba4934256e8434eedf2b8ad8f08e7
SSDEEP 24576:wRsP7pqUqbVQWD0bFc9+jPP07LV/GFfZ8O+bWMcUBLb1:xqUQCbDjPPaLVO0O+b/9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubisoft.exe

Path \Users\Admin\AppData\Local\Temp\Ubisoft.exe
Size 1.5MB
SHA256 35934fa08336d8dd4a47f495a9a39a2b055e45e0ffa6058d375bfb562f9c87c2
MD5 49ea5876ebd50e9dc4abf82075543af3
SHA1 738f86ae40a01e6abcfd687e680ec42c96882caa
SHA512 1119dde5c345e6ef9cba5bd52ec97a4297e7ed7516c8a17f7683683bb68d4a4622ccb5952453c1d78fb61dbb21dc8896c8aba4934256e8434eedf2b8ad8f08e7
SSDEEP 24576:wRsP7pqUqbVQWD0bFc9+jPP07LV/GFfZ8O+bWMcUBLb1:xqUQCbDjPPaLVO0O+b/9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubisoft.exe

Path \Users\Admin\AppData\Local\Temp\Ubisoft.exe
Size 1.5MB
SHA256 35934fa08336d8dd4a47f495a9a39a2b055e45e0ffa6058d375bfb562f9c87c2
MD5 49ea5876ebd50e9dc4abf82075543af3
SHA1 738f86ae40a01e6abcfd687e680ec42c96882caa
SHA512 1119dde5c345e6ef9cba5bd52ec97a4297e7ed7516c8a17f7683683bb68d4a4622ccb5952453c1d78fb61dbb21dc8896c8aba4934256e8434eedf2b8ad8f08e7
SSDEEP 24576:wRsP7pqUqbVQWD0bFc9+jPP07LV/GFfZ8O+bWMcUBLb1:xqUQCbDjPPaLVO0O+b/9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-102-0x0000000001120000-0x00000000012D2000-memory.dmp

Download

memory/1508-77-0x000000001B760000-0x000000001BA5F000-memory.dmp

Download

memory/1508-78-0x000000000281B000-0x000000000283A000-memory.dmp

Download

memory/1508-80-0x000000000281B000-0x000000000283A000-memory.dmp

Download

memory/1508-79-0x0000000002814000-0x0000000002817000-memory.dmp

Download

memory/1508-73-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download

memory/1508-74-0x000007FEEBAB0000-0x000007FEEC4D3000-memory.dmp

Download

memory/1508-76-0x0000000002814000-0x0000000002817000-memory.dmp

Download

memory/1508-75-0x000007FEEAF50000-0x000007FEEBAAD000-memory.dmp

Download

memory/1684-54-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1684-64-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Download

memory/1684-56-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1684-62-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1684-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1780-71-0x0000000000700000-0x0000000000792000-memory.dmp

Download

memory/1780-70-0x0000000000EF0000-0x0000000000FDA000-memory.dmp

Download

memory/1780-69-0x0000000001390000-0x000000000151C000-memory.dmp

Download

memory/1912-83-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-91-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-92-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-89-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-97-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-98-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-87-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-86-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-85-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1912-82-0x0000000140000000-0x0000000140166000-memory.dmp

Download