redline | b4b8d49ce8ac2c756f6d65399e71a15fc46814f4aee055bcc99cbb7d1d50cd88

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 802KB
Sample221102-sefxqsccel
SHA256 b4b8d49ce8ac2c756f6d65399e71a15fc46814f4aee055bcc99cbb7d1d50cd88
MD5 84804afe0c78ee7e1f684a22ef64df46
SHA1 5c2de5e0d5b79fb04da7bb5d6f522736098c640d
SHA512 785534c14c49a4968d4a49b0d0ecc5f6b3e8bb55261ff087c4ab1f27ff2b4f041ac46584856d5d1060af0bd5a641dcae7271790cc0f37a83f9cf13b67b69f117
SSDEEP 12288:4zUP2bEOlWzErxf9FiW7L7ELUkTERkWGvK2Zk04BHCze7nTm:4hbEOfx937yXwOVz6tna
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline infostealer persistence spyware

Malware Config

Extracted

Family

redline

45.142.212.245:15536

Attributes

auth_value
fb1de879c48ed88b0b3d95be8ac26793

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 1 IoCs

pid	Process
4748	Engage.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 4956	4748	Engage.exe.pif	99

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4924	tasklist.exe
2744	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3320	PING.EXE
4356	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif
4956	jsc.exe
4956	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	4956	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4748	Engage.exe.pif
4748	Engage.exe.pif
4748	Engage.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3956	3972	file.exe	79
PID 3972 wrote to memory of 3956	3972	file.exe	79
PID 3972 wrote to memory of 3956	3972	file.exe	79
PID 3972 wrote to memory of 792	3972	file.exe	81
PID 3972 wrote to memory of 792	3972	file.exe	81
PID 3972 wrote to memory of 792	3972	file.exe	81
PID 792 wrote to memory of 4284	792	cmd.exe	83
PID 792 wrote to memory of 4284	792	cmd.exe	83
PID 792 wrote to memory of 4284	792	cmd.exe	83
PID 4284 wrote to memory of 2744	4284	cmd.exe	84
PID 4284 wrote to memory of 2744	4284	cmd.exe	84
PID 4284 wrote to memory of 2744	4284	cmd.exe	84
PID 4284 wrote to memory of 4880	4284	cmd.exe	85
PID 4284 wrote to memory of 4880	4284	cmd.exe	85
PID 4284 wrote to memory of 4880	4284	cmd.exe	85
PID 4284 wrote to memory of 4924	4284	cmd.exe	86
PID 4284 wrote to memory of 4924	4284	cmd.exe	86
PID 4284 wrote to memory of 4924	4284	cmd.exe	86
PID 4284 wrote to memory of 4864	4284	cmd.exe	87
PID 4284 wrote to memory of 4864	4284	cmd.exe	87
PID 4284 wrote to memory of 4864	4284	cmd.exe	87
PID 4284 wrote to memory of 4848	4284	cmd.exe	88
PID 4284 wrote to memory of 4848	4284	cmd.exe	88
PID 4284 wrote to memory of 4848	4284	cmd.exe	88
PID 4284 wrote to memory of 4748	4284	cmd.exe	89
PID 4284 wrote to memory of 4748	4284	cmd.exe	89
PID 4284 wrote to memory of 4748	4284	cmd.exe	89
PID 4284 wrote to memory of 3320	4284	cmd.exe	90
PID 4284 wrote to memory of 3320	4284	cmd.exe	90
PID 4284 wrote to memory of 3320	4284	cmd.exe	90
PID 792 wrote to memory of 4356	792	cmd.exe	91
PID 792 wrote to memory of 4356	792	cmd.exe	91
PID 792 wrote to memory of 4356	792	cmd.exe	91
PID 4748 wrote to memory of 4956	4748	Engage.exe.pif	99
PID 4748 wrote to memory of 4956	4748	Engage.exe.pif	99
PID 4748 wrote to memory of 4956	4748	Engage.exe.pif	99
PID 4748 wrote to memory of 4956	4748	Engage.exe.pif	99
PID 4748 wrote to memory of 4956	4748	Engage.exe.pif	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Street.eps & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2744
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:4880
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:4864
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^CiEyGyHZjwhzv$" Pharmaceuticals.eps
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
      Engage.exe.pif z
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:4356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Engage.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Engage.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pharmaceuticals.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pharmaceuticals.eps
Size 924KB
SHA256 be95b12e8496d96807678b1aff19b5743bb2a4d3b0f7f8b182d72cc6d010af6d
MD5 356bbe3005daf17b1df15999187f0626
SHA1 f937584ed3ca9d58fe0ea0cc72785d7abffdca4c
SHA512 dc2100df96bd90d8562cc6983b11fc0631a02b58edc786798502dbba228acfc979d3407a73f6e0040e878cfca249637a8a836cc96aca0a868852f6e0d354388b
SSDEEP 24576:OErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:O86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Regulations.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Regulations.eps
Size 714KB
SHA256 248d524bd68f88bbca665bb61fb545f9ea5a87d25ea38f2bb309d1a6bf77ff51
MD5 c498ac2ec17f022f933540c028b1b8ff
SHA1 72fff639eb25cda9d27e740273303353dd38cb12
SHA512 f6aec2ed90925089d821c04356c700993a961d09a7fc987d65abbb13851360082bc89051081014f7ddd6de5fc3d75380065e1c93fa889e97ca2aeb4352160e42
SSDEEP 12288:7A/fFVB++D+5JLrg/mGJW0wt2ReJhQxKw:YfXB++D+5mzI0AO5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Street.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Street.eps
Size 11KB
SHA256 7c4debb31b795c303d7c5864cab7113dc03ec3dd289cbf4871b2a00b9413adcc
MD5 a5ebe66feba15c4a346787d67c56b506
SHA1 3ca892231c6e435e49abfa9bf9036cfb7ad5f18d
SHA512 3ee6abe6b609a5b5aa70cb8ff7b5ea154f10af18373b4a7bb74e75a1aa91b67a888f6e65f5d2c3ee7614fffb75726f5693631c64d4bfdd902324589eacb56355
SSDEEP 192:49+KDTgOHAvZULoYT+jEO7E0xtzDzsfZ/ulhJFmz6gUFDyKlhJFRCUFDyToG2Ny+:49+nlxULoY+EqTxG+
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnJsYhLhyWk.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wnJsYhLhyWk.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4956-153-0x0000000000500000-0x0000000000538000-memory.dmp

Download

memory/4956-157-0x0000000004F40000-0x0000000005558000-memory.dmp

Download

memory/4956-158-0x0000000004980000-0x0000000004992000-memory.dmp

Download

memory/4956-159-0x0000000004AB0000-0x0000000004BBA000-memory.dmp

Download

memory/4956-160-0x0000000004A20000-0x0000000004A5C000-memory.dmp

Download

memory/4956-161-0x0000000004D30000-0x0000000004D96000-memory.dmp

Download

memory/4956-162-0x0000000005E10000-0x00000000063B4000-memory.dmp

Download

memory/4956-163-0x0000000005910000-0x00000000059A2000-memory.dmp

Download

memory/4956-164-0x0000000006790000-0x0000000006952000-memory.dmp

Download

memory/4956-165-0x00000000073A0000-0x00000000078CC000-memory.dmp

Download

memory/4956-166-0x0000000006640000-0x00000000066B6000-memory.dmp

Download

memory/4956-167-0x00000000065C0000-0x00000000065DE000-memory.dmp

Download

memory/4956-168-0x0000000006710000-0x0000000006760000-memory.dmp

Download