redline | 9d3564ac6df36d5ce940f2e38c81e0d9fb4c611ec5a05c66c56603e74414cadb

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.7MB
MD5

87d3b3a7055aada6ea31de97cf092bc1
SHA1

2580afff4aac4d1adb57edd45b466d8ecaebea15
SHA256

9d3564ac6df36d5ce940f2e38c81e0d9fb4c611ec5a05c66c56603e74414cadb
SHA512

2bfa6f548c54d108a6ab25bc1a5e4d1ecfa6a6a461b29e4ae096a9c25db029baac24d282d32f11fd12043d1e8bd170410313eb1472bd2a7851ca371e37c3c6a4
SSDEEP

49152:lHtHbLXz8obGwZk4beLC312SY/t+UPr4lwB6m8JG5Gtizs/rMM2F:lN7zztbeLRSAtfiwB6mRQJEF

Score

10^/10

redline new1109 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

new1109

jalocliche.xyz:81

chardhesha.xyz:81

Attributes

auth_value
4e1b0eea6916e5eec6474516190b3725

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/276-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/276-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/276-68-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1244 set thread context of 276 1244 file.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

file.exeInstallUtil.exe

pid process

1244 file.exe
1244 file.exe
1244 file.exe
1244 file.exe
1244 file.exe
276 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 276 InstallUtil.exe

description	pid	process	target process
PID 1244 set thread context of 276	1244	file.exe	InstallUtil.exe

pid	process
1244	file.exe
1244	file.exe
1244	file.exe
1244	file.exe
1244	file.exe
276	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	276	InstallUtil.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe
PID 1244 wrote to memory of 276	1244	file.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/276-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/276-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/276-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1244-54-0x0000000001F60000-0x00000000026A7000-memory.dmp

Filesize
7.3MB

Download
memory/1244-55-0x0000000001F60000-0x00000000026A7000-memory.dmp

Filesize
7.3MB

Download
memory/1244-56-0x00000000026B0000-0x0000000002822000-memory.dmp

Filesize
1.4MB

Download
memory/1244-57-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1244-58-0x000000000B320000-0x000000000B49F000-memory.dmp

Filesize
1.5MB

Download
memory/1244-59-0x00000000026B0000-0x0000000002822000-memory.dmp

Filesize
1.4MB

Download
memory/1244-60-0x000000000B320000-0x000000000B49F000-memory.dmp

Filesize
1.5MB

Download
memory/1244-65-0x00000000026B0000-0x0000000002822000-memory.dmp

Filesize
1.4MB

Download