redline | b3abbc4d6ecd9a9774e53fca4639b59cd5e24fde9bf97742b046ece663eb2e41

Analysis

max time kernel
68s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2022, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 797KB
Sample221104-ymjw9acdaq
SHA256 b3abbc4d6ecd9a9774e53fca4639b59cd5e24fde9bf97742b046ece663eb2e41
MD5 24d01773214d215ff114c720163073b5
SHA1 82a92b9a7adc212dbdd23d10d3bc6f17250a7b00
SHA512 3f88cf59fa3c9c707e5634b98999a2eb7add647574db5bb9d1d51427b20db299d62e81de04a5766afd97281638ce8696bcb23b94de136f9a280081ad28b14433
SSDEEP 12288:tzLUeDNHKkMVfxeiO28gxMRCSu4MwwkILw6kh3K9/5BkeV9irmJklE0TGGK:txjMVfsHDxIc3K9x+iiiJuEe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 0 infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

37.139.128.164:31198

Attributes

auth_value
a9fbe79e54cd578a840d653845132f9a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 1 IoCs

pid	Process
3008	Finished.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 3204	3008	Finished.exe.pif	94

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1540	tasklist.exe
4132	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4288	PING.EXE
5016	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif
3204	jsc.exe
3204	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	4132	tasklist.exe
Token: SeDebugPrivilege	3204	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3008	Finished.exe.pif
3008	Finished.exe.pif
3008	Finished.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4508	4808	file.exe	79
PID 4808 wrote to memory of 4508	4808	file.exe	79
PID 4808 wrote to memory of 4508	4808	file.exe	79
PID 4808 wrote to memory of 4868	4808	file.exe	80
PID 4808 wrote to memory of 4868	4808	file.exe	80
PID 4808 wrote to memory of 4868	4808	file.exe	80
PID 4868 wrote to memory of 64	4868	cmd.exe	82
PID 4868 wrote to memory of 64	4868	cmd.exe	82
PID 4868 wrote to memory of 64	4868	cmd.exe	82
PID 64 wrote to memory of 1540	64	cmd.exe	83
PID 64 wrote to memory of 1540	64	cmd.exe	83
PID 64 wrote to memory of 1540	64	cmd.exe	83
PID 64 wrote to memory of 3532	64	cmd.exe	84
PID 64 wrote to memory of 3532	64	cmd.exe	84
PID 64 wrote to memory of 3532	64	cmd.exe	84
PID 64 wrote to memory of 4132	64	cmd.exe	85
PID 64 wrote to memory of 4132	64	cmd.exe	85
PID 64 wrote to memory of 4132	64	cmd.exe	85
PID 64 wrote to memory of 3512	64	cmd.exe	86
PID 64 wrote to memory of 3512	64	cmd.exe	86
PID 64 wrote to memory of 3512	64	cmd.exe	86
PID 64 wrote to memory of 3664	64	cmd.exe	87
PID 64 wrote to memory of 3664	64	cmd.exe	87
PID 64 wrote to memory of 3664	64	cmd.exe	87
PID 64 wrote to memory of 3008	64	cmd.exe	88
PID 64 wrote to memory of 3008	64	cmd.exe	88
PID 64 wrote to memory of 3008	64	cmd.exe	88
PID 64 wrote to memory of 4288	64	cmd.exe	89
PID 64 wrote to memory of 4288	64	cmd.exe	89
PID 64 wrote to memory of 4288	64	cmd.exe	89
PID 4868 wrote to memory of 5016	4868	cmd.exe	90
PID 4868 wrote to memory of 5016	4868	cmd.exe	90
PID 4868 wrote to memory of 5016	4868	cmd.exe	90
PID 3008 wrote to memory of 3204	3008	Finished.exe.pif	94
PID 3008 wrote to memory of 3204	3008	Finished.exe.pif	94
PID 3008 wrote to memory of 3204	3008	Finished.exe.pif	94
PID 3008 wrote to memory of 3204	3008	Finished.exe.pif	94
PID 3008 wrote to memory of 3204	3008	Finished.exe.pif	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\tapiunattend.exe
  tapiunattend.exe
  2⤵
  PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Supporting.aspx & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1540
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4132
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^nuGgmUwoRXm$" Jp.aspx
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
      Finished.exe.pif T
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Finished.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finished.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Him.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Him.aspx
Size 713KB
SHA256 99badb2591955cb46fb72b4ff2ffa7611d31d0abbbaa5613fec80c900307fbd4
MD5 8322af58d0e58367766896afdab5524a
SHA1 7a22d1a1ce77205d75ef9ce52d2df34dc8868a4b
SHA512 3889ec99ce059302b0351f5babe9802fd8d2edef001dc4cd87fb92a5e0a4a848dad57fcff66393bae2fdaef7dde18149f22e48aa0b1221905f5190680dbbfd1a
SSDEEP 6144:Z1F4XwlLQkpuufwxAjj2RKZgRrOTEMKJ5/gGSerHN69t0tutIrePEj2VREm8S6Z3:Z1d6AfQDxH9/gGSWN69t0tutjNEmOXN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jp.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jp.aspx
Size 925KB
SHA256 26fde5b82ae2dc28a3f0e382626e72ea2dbd7858ed99aa132a629b39e445981f
MD5 e902b73edbcc01363e0335533c6ebf8f
SHA1 a48839a6eaf1cf8db2dc1592666f071b7de1d4ae
SHA512 ba1a0d139b0c286fa30ce92878f662c0e6feafeb0173be11e2f068738ab235f7e11bb8bcc1284c1be2358420d53da72130ffe19bb2debed5a1575e98944e4def
SSDEEP 24576:NYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:N37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Supporting.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Supporting.aspx
Size 12KB
SHA256 6f36aab1348b4235b403a7cee5ef59f879bf54b916f1b8ff5f3696327dbc973d
MD5 86901ca49bae85011c7767681734a99a
SHA1 198f6967241a1d403924b4c03a6d11b98d7464fa
SHA512 049a327660139da57a71ecae192591c262d86c592144a4aabaaaac47b9292ccaa72ac3f41cbeb78725ea4668fa410d348a6fc4eae136a657498191b83c265189
SSDEEP 192:Kb0XMBtY1947lTv7sv8QtUvM8/BiBBn4HOAGRFq5t7UsOAGQqR7U3BclE:KYYtY3lU5Bi3nBfXQtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiTTjiFL.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fiTTjiFL.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3204-161-0x0000000005220000-0x0000000005286000-memory.dmp

Download

memory/3204-163-0x00000000063F0000-0x0000000006994000-memory.dmp

Download

memory/3204-168-0x0000000006A40000-0x0000000006A5E000-memory.dmp

Download

memory/3204-167-0x0000000007980000-0x0000000007EAC000-memory.dmp

Download

memory/3204-166-0x0000000006B70000-0x0000000006D32000-memory.dmp

Download

memory/3204-165-0x0000000005F80000-0x0000000005FF6000-memory.dmp

Download

memory/3204-153-0x00000000005A0000-0x00000000005D6000-memory.dmp

Download

memory/3204-164-0x0000000005EB0000-0x0000000005F00000-memory.dmp

Download

memory/3204-162-0x0000000005DA0000-0x0000000005E32000-memory.dmp

Download

memory/3204-157-0x00000000053E0000-0x00000000059F8000-memory.dmp

Download

memory/3204-158-0x0000000004E80000-0x0000000004E92000-memory.dmp

Download

memory/3204-159-0x0000000004FB0000-0x00000000050BA000-memory.dmp

Download

memory/3204-160-0x0000000004F20000-0x0000000004F5C000-memory.dmp

Download