redline | 0f9259d9ec6ddbceffacb00972ebb9da2e64a6394be718d429a1098309cee3f7

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 218KB
Sample221113-pf13hsbb53
SHA256 0f9259d9ec6ddbceffacb00972ebb9da2e64a6394be718d429a1098309cee3f7
MD5 39bf0830a1bf7b09f4003d9a5aa5ee61
SHA1 d4815979335cdc3fe707021e78d2f6700e477d19
SHA512 50de828f051e12256c9689c7b89e743331b0c5f7e1f17801f09d93bff8494081e0d400efa184571cfadb7b6aadb4d1d25e6c48fd44a5f493beb647890337c78e
SSDEEP 3072:dhwEAeBDfEHTGYpYfFP9G4YcpHprAWWxAX+EuPCA5Xxw0qoXm5c84DRglg4bHJ:dShiEH6zXHljWxL35XS032c3DRgSYHJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

213.32.44.120:6254

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2040-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/2040-61-0x00000000004221EE-mapping.dmp	family_redline
behavioral1/memory/2040-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/2040-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1096-65-0x0000000000320000-0x0000000000359000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1940	crea.exe
516	sbdf.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000015c68-72.dat	upx
behavioral1/files/0x0007000000015c68-73.dat	upx
behavioral1/files/0x0007000000015c68-75.dat	upx

Loads dropped DLL 3 IoCs

pid	Process
2040	vbc.exe
1940	crea.exe
1940	crea.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 2040	1096	file.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	1096	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	vbc.exe
2040	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	vbc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2040	1096	file.exe	27
PID 1096 wrote to memory of 2020	1096	file.exe	28
PID 1096 wrote to memory of 2020	1096	file.exe	28
PID 1096 wrote to memory of 2020	1096	file.exe	28
PID 1096 wrote to memory of 2020	1096	file.exe	28
PID 2040 wrote to memory of 1940	2040	vbc.exe	30
PID 2040 wrote to memory of 1940	2040	vbc.exe	30
PID 2040 wrote to memory of 1940	2040	vbc.exe	30
PID 2040 wrote to memory of 1940	2040	vbc.exe	30
PID 1940 wrote to memory of 516	1940	crea.exe	31
PID 1940 wrote to memory of 516	1940	crea.exe	31
PID 1940 wrote to memory of 516	1940	crea.exe	31
PID 1940 wrote to memory of 516	1940	crea.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\crea.exe
    "C:\Users\Admin\AppData\Local\Temp\crea.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\Temp\sbdf.exe
      "C:\Windows\Temp\sbdf.exe"
      4⤵
      Executes dropped EXE
      PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 88
  2⤵
  - Program crash
  PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crea.exe

Path C:\Users\Admin\AppData\Local\Temp\crea.exe
Size 3.0MB
SHA256 f781f88ce4f6779c88d4fd2b43e73a19787b554f18b0e0b956a6af04fa8df4d3
MD5 811fe03e7165d5916b655493e6f783b6
SHA1 becd1524623d147b24626e5e573cf4f57a466e34
SHA512 ba1a1d67a7bb0766f2b5b04c1111109153972cba144994fe050bc3d907fc676922cf55c51916710e136752e110f0b4b74f630ba3fddd69e71b290db99bd8f041
SSDEEP 49152:xLP4oAALfFAPgkwxuv+7vZoBB41KC+LQDA+6WEMSA1JbK577dnO:h4mLt8g7QqxoBB4/6QDA2ETA38ZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

crea.exe

Path C:\Users\Admin\AppData\Local\Temp\crea.exe
Size 3.0MB
SHA256 f781f88ce4f6779c88d4fd2b43e73a19787b554f18b0e0b956a6af04fa8df4d3
MD5 811fe03e7165d5916b655493e6f783b6
SHA1 becd1524623d147b24626e5e573cf4f57a466e34
SHA512 ba1a1d67a7bb0766f2b5b04c1111109153972cba144994fe050bc3d907fc676922cf55c51916710e136752e110f0b4b74f630ba3fddd69e71b290db99bd8f041
SSDEEP 49152:xLP4oAALfFAPgkwxuv+7vZoBB41KC+LQDA+6WEMSA1JbK577dnO:h4mLt8g7QqxoBB4/6QDA2ETA38ZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbdf.exe

Path C:\Windows\Temp\sbdf.exe
Size 2.8MB
SHA256 35cd1bf49e55ceadbf29767fe476d0c5579fae99c32f15138404cb999014ede4
MD5 e98e5ac2b06f79c6545cd74766f4c83b
SHA1 fcf66508e629c87432b49d75f6efe0f26fbf7cb5
SHA512 2f3e971ac7ff84cb046b55bfeab077ece0149bf6c7b21e477d4ed091cabc05a4f2df54ec568a32ba491f59baa1f51e1e374e34e4baef2266c0d65702c5608707
SSDEEP 49152:ztuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTu:YwxC3t+kntXODSC0Ns10aWTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

crea.exe

Path \Users\Admin\AppData\Local\Temp\crea.exe
Size 3.0MB
SHA256 f781f88ce4f6779c88d4fd2b43e73a19787b554f18b0e0b956a6af04fa8df4d3
MD5 811fe03e7165d5916b655493e6f783b6
SHA1 becd1524623d147b24626e5e573cf4f57a466e34
SHA512 ba1a1d67a7bb0766f2b5b04c1111109153972cba144994fe050bc3d907fc676922cf55c51916710e136752e110f0b4b74f630ba3fddd69e71b290db99bd8f041
SSDEEP 49152:xLP4oAALfFAPgkwxuv+7vZoBB41KC+LQDA+6WEMSA1JbK577dnO:h4mLt8g7QqxoBB4/6QDA2ETA38ZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbdf.exe

Path \Windows\Temp\sbdf.exe
Size 2.8MB
SHA256 35cd1bf49e55ceadbf29767fe476d0c5579fae99c32f15138404cb999014ede4
MD5 e98e5ac2b06f79c6545cd74766f4c83b
SHA1 fcf66508e629c87432b49d75f6efe0f26fbf7cb5
SHA512 2f3e971ac7ff84cb046b55bfeab077ece0149bf6c7b21e477d4ed091cabc05a4f2df54ec568a32ba491f59baa1f51e1e374e34e4baef2266c0d65702c5608707
SSDEEP 49152:ztuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTu:YwxC3t+kntXODSC0Ns10aWTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbdf.exe

Path \Windows\Temp\sbdf.exe
Size 2.8MB
SHA256 35cd1bf49e55ceadbf29767fe476d0c5579fae99c32f15138404cb999014ede4
MD5 e98e5ac2b06f79c6545cd74766f4c83b
SHA1 fcf66508e629c87432b49d75f6efe0f26fbf7cb5
SHA512 2f3e971ac7ff84cb046b55bfeab077ece0149bf6c7b21e477d4ed091cabc05a4f2df54ec568a32ba491f59baa1f51e1e374e34e4baef2266c0d65702c5608707
SSDEEP 49152:ztuwk5i9rt3ROwvStyJWv4i7OxsHn4A5X0FrLL9RVI8P0N7gAAB99id5uWTu:YwxC3t+kntXODSC0Ns10aWTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-65-0x0000000000320000-0x0000000000359000-memory.dmp

Download

memory/2040-66-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Download

memory/2040-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2040-62-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2040-54-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2040-56-0x0000000000400000-0x0000000000428000-memory.dmp

Download