redline | 1ce2a17f4a476674dbf6cf4e15c6d3ae424eee86f484edc38c9e6fdf97805bc8

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 696KB
Sample221111-sdwlssgd65
SHA256 1ce2a17f4a476674dbf6cf4e15c6d3ae424eee86f484edc38c9e6fdf97805bc8
MD5 9cca21b33d1141cf733bef2c6eb2c387
SHA1 40c22c19a756a64646eaf3ca5ecbdabc49da3bea
SHA512 c2e4b4b8dae453f3551035f85d3f49e688e96e3d3051daa10e2dc473a2bb4c4b8658971f19903ba39058b94abe8f37e9d37bb74dfaecd6721e75b738acb1727c
SSDEEP 12288:lEfScoAK5cwYqmmdpkbAStnkeemEiXJjHQKRaXQ/MRZuXXqzgZu4PeliNH+fLg:lEfSclK5cwYqmucEiXpHQKRhU+pPrNp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

145.239.202.9:4120

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1148-54-0x0000000000AB0000-0x0000000000B62000-memory.dmp	family_redline
behavioral1/memory/1392-57-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1392-62-0x00000000004221EE-mapping.dmp	family_redline
behavioral1/memory/1392-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1392-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2012	crea.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000122c0-67.dat	upx
behavioral1/files/0x00090000000122c0-68.dat	upx
behavioral1/files/0x00090000000122c0-70.dat	upx
behavioral1/memory/2012-71-0x0000000001330000-0x0000000001B1B000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1392	vbc.exe
1392	vbc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1148 set thread context of 1392	1148	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1148	WerFault.exe	26

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	vbc.exe
1392	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1392	1148	file.exe	28
PID 1148 wrote to memory of 1288	1148	file.exe	29
PID 1148 wrote to memory of 1288	1148	file.exe	29
PID 1148 wrote to memory of 1288	1148	file.exe	29
PID 1148 wrote to memory of 1288	1148	file.exe	29
PID 1392 wrote to memory of 2012	1392	vbc.exe	31
PID 1392 wrote to memory of 2012	1392	vbc.exe	31
PID 1392 wrote to memory of 2012	1392	vbc.exe	31
PID 1392 wrote to memory of 2012	1392	vbc.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\crea.exe
    "C:\Users\Admin\AppData\Local\Temp\crea.exe"
    3⤵
    - Executes dropped EXE
    PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 96
  2⤵
  - Program crash
  PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crea.exe

Path C:\Users\Admin\AppData\Local\Temp\crea.exe
Size 2.8MB
SHA256 04fe07d90517db69b7fdf65d79073ab72352736a6ff667e38c3b39266f6e5893
MD5 e3d7ace4b373acbc97dfa59be0afadda
SHA1 6812efaa5df5d1360544ac9327dc7032e24cc5b3
SHA512 117114498595f03a36b2a22c0f642b41cdfaf39d4e131bf7dbe7f53675df4a8c38294120ffbecb810ac195a22a9540214b725279e5ca78daa90ce96846e6f6a4
SSDEEP 49152:Jtuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTZ:GwxC3t+kntXODSC0Ns10aWTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

crea.exe

Path \Users\Admin\AppData\Local\Temp\crea.exe
Size 2.8MB
SHA256 04fe07d90517db69b7fdf65d79073ab72352736a6ff667e38c3b39266f6e5893
MD5 e3d7ace4b373acbc97dfa59be0afadda
SHA1 6812efaa5df5d1360544ac9327dc7032e24cc5b3
SHA512 117114498595f03a36b2a22c0f642b41cdfaf39d4e131bf7dbe7f53675df4a8c38294120ffbecb810ac195a22a9540214b725279e5ca78daa90ce96846e6f6a4
SSDEEP 49152:Jtuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTZ:GwxC3t+kntXODSC0Ns10aWTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

crea.exe

Path \Users\Admin\AppData\Local\Temp\crea.exe
Size 2.8MB
SHA256 04fe07d90517db69b7fdf65d79073ab72352736a6ff667e38c3b39266f6e5893
MD5 e3d7ace4b373acbc97dfa59be0afadda
SHA1 6812efaa5df5d1360544ac9327dc7032e24cc5b3
SHA512 117114498595f03a36b2a22c0f642b41cdfaf39d4e131bf7dbe7f53675df4a8c38294120ffbecb810ac195a22a9540214b725279e5ca78daa90ce96846e6f6a4
SSDEEP 49152:Jtuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTZ:GwxC3t+kntXODSC0Ns10aWTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-54-0x0000000000AB0000-0x0000000000B62000-memory.dmp

Download

memory/1392-64-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1392-66-0x0000000074C11000-0x0000000074C13000-memory.dmp

Download

memory/1392-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1392-57-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1392-55-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2012-71-0x0000000001330000-0x0000000001B1B000-memory.dmp

Download