redline | 431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361

Analysis

max time kernel
69s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

5e7c07b9aa0668fa2971747bb4fade1e
SHA1

7fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256

431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA512

5c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
SSDEEP

24576:UFN0MuPkLGGnOSibw038m26NvoxP9pR3asqdKX+iu+dLP22ALaCET:GWkBSTNqxP9f3aDi+iugT

Score

10^/10

redline rozena1114 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

rozena1114

jalocliche.xyz:81

chardhesha.xyz:81

Attributes

auth_value
9fefd743a3b62bcd7c3e17a70fbdb3a8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3136-139-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file
Loads dropped DLL 2 IoCs

Processes:

file.exe

pid process

5068 file.exe
5068 file.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 5068 set thread context of 3136 5068 file.exe ngentask.exe
Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

file.exengentask.exe

pid process

5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
5068 file.exe
3136 ngentask.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ngentask.exe

description pid process

Token: SeDebugPrivilege 3136 ngentask.exe

pid	process
5068	file.exe
5068	file.exe

description	pid	process	target process
PID 5068 set thread context of 3136	5068	file.exe	ngentask.exe

pid	process
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
5068	file.exe
3136	ngentask.exe

description	pid	process
Token: SeDebugPrivilege	3136	ngentask.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

file.exe

description	pid	process	target process
PID 5068 wrote to memory of 3136	5068	file.exe	ngentask.exe
PID 5068 wrote to memory of 3136	5068	file.exe	ngentask.exe
PID 5068 wrote to memory of 3136	5068	file.exe	ngentask.exe
PID 5068 wrote to memory of 3136	5068	file.exe	ngentask.exe
PID 5068 wrote to memory of 3136	5068	file.exe	ngentask.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\advapi32.dll
Filesize
1.1MB

MD5
486536825ff5e3219a8702319e064907

SHA1
34f7f9211e2fd9c166fb36ed1d4121ebd427bebd

SHA256
6ab2023a2bd76692a694a812bf86c341696810c61666586c09a343832f05dc01

SHA512
f77404db724b9f8e93d84f2f9f0cee10b05638bda4445facbfd262eca52f073e285c10f153133fc35f9a426eb84e87e8e0b320f2815b2405ca3ada7ac2fded4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\advapi32.dll
Filesize
1.1MB

MD5
486536825ff5e3219a8702319e064907

SHA1
34f7f9211e2fd9c166fb36ed1d4121ebd427bebd

SHA256
6ab2023a2bd76692a694a812bf86c341696810c61666586c09a343832f05dc01

SHA512
f77404db724b9f8e93d84f2f9f0cee10b05638bda4445facbfd262eca52f073e285c10f153133fc35f9a426eb84e87e8e0b320f2815b2405ca3ada7ac2fded4c

Download Submit
memory/3136-143-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/3136-148-0x0000000006B40000-0x0000000006BA6000-memory.dmp

Filesize
408KB

Download
memory/3136-136-0x0000000000000000-mapping.dmp

Download
memory/3136-137-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3136-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3136-140-0x0000000005E70000-0x0000000006488000-memory.dmp

Filesize
6.1MB

Download
memory/3136-141-0x00000000059F0000-0x0000000005AFA000-memory.dmp

Filesize
1.0MB

Download
memory/3136-142-0x0000000005930000-0x0000000005942000-memory.dmp

Filesize
72KB

Download
memory/3136-152-0x0000000007E80000-0x00000000083AC000-memory.dmp

Filesize
5.2MB

Download
memory/3136-151-0x0000000007110000-0x00000000072D2000-memory.dmp

Filesize
1.8MB

Download
memory/3136-150-0x00000000073A0000-0x0000000007944000-memory.dmp

Filesize
5.6MB

Download
memory/3136-149-0x0000000006D50000-0x0000000006DE2000-memory.dmp

Filesize
584KB

Download
memory/5068-147-0x0000000003153000-0x0000000003251000-memory.dmp

Filesize
1016KB

Download
memory/5068-135-0x000000000E8E0000-0x000000000EA5F000-memory.dmp

Filesize
1.5MB

Download
memory/5068-146-0x0000000002C30000-0x0000000002C36000-memory.dmp

Filesize
24KB

Download
memory/5068-133-0x0000000003153000-0x0000000003251000-memory.dmp

Filesize
1016KB

Download
memory/5068-134-0x000000000E8E0000-0x000000000EA5F000-memory.dmp

Filesize
1.5MB

Download
memory/5068-132-0x0000000002C3C000-0x000000000314A000-memory.dmp

Filesize
5.1MB

Download