redline | f7e5f54f191a24a82817b043e7e69e2d4e5206deba503de68a1d163b08d0ee8e

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2022, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 355KB
Sample221108-l3dc7aahe9
SHA256 f7e5f54f191a24a82817b043e7e69e2d4e5206deba503de68a1d163b08d0ee8e
MD5 13f8da26450ba6f7132c1f761609c512
SHA1 0eef6ef4852211dbb60209c7532b0ae5f1b43e3a
SHA512 959db6d9178067e404fda2b38e8ad99620a19ead153c1c753ef2a4b9bbf71c7a06469030031fc81f732a2f5678a16c3c8e9b4e19f390ac0c103af18c6cd40b91
SSDEEP 6144:yhSh82NXJg9WmuTbqYoGxhXmYM/fIIAOBbHUKKafrsi/AYIH74snKF2rxpm:d/muTbqYjMoI/bHzn//AY4+2tA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 711 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

194.110.203.100:32796

Attributes

auth_value
24e3340d853c89cad1e25194559ee778

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5052-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4388 set thread context of 5052	4388	file.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4776	4388	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	AppLaunch.exe
5052	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5052	4388	file.exe	81
PID 4388 wrote to memory of 5052	4388	file.exe	81
PID 4388 wrote to memory of 5052	4388	file.exe	81
PID 4388 wrote to memory of 5052	4388	file.exe	81
PID 4388 wrote to memory of 5052	4388	file.exe	81

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 268
  2⤵
  - Program crash
  PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4388 -ip 4388
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5052-133-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5052-138-0x0000000005E70000-0x0000000006488000-memory.dmp

Download

memory/5052-139-0x0000000006490000-0x000000000659A000-memory.dmp

Download

memory/5052-140-0x0000000005DF0000-0x0000000005E02000-memory.dmp

Download

memory/5052-141-0x00000000078F0000-0x000000000792C000-memory.dmp

Download

memory/5052-142-0x0000000008330000-0x00000000083C2000-memory.dmp

Download

memory/5052-143-0x0000000008980000-0x0000000008F24000-memory.dmp

Download

memory/5052-144-0x0000000008440000-0x00000000084A6000-memory.dmp

Download

memory/5052-145-0x0000000008780000-0x0000000008942000-memory.dmp

Download

memory/5052-146-0x0000000009460000-0x000000000998C000-memory.dmp

Download

memory/5052-147-0x00000000086D0000-0x0000000008746000-memory.dmp

Download

memory/5052-148-0x0000000008F30000-0x0000000008F80000-memory.dmp

Download