redline | 332f57c8ce6494cea7672f91ef41bbf4db074db03e82a69b6fc2f90c7e9f1c99

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2022, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 860KB
Sample221118-r21d8ade4y
SHA256 332f57c8ce6494cea7672f91ef41bbf4db074db03e82a69b6fc2f90c7e9f1c99
MD5 91fee63660d7b6a0123bfaa14fae0c18
SHA1 a54b3d5dcc75cac3a6a88dbb957fa76c74e82583
SHA512 c8b973ae9c850526eb32c342fef077368deb35f8948cede7755573e3d1fe1c555673252dbf0183a835eb505d28957606b1503cb56783635b00e0296b8b126faf
SSDEEP 12288:0z/rkxfSIU+QlPomjIT/QSlLzcqIpGD0/1FoIadQ/0:00dSIL8gmjU/1PUIm1FoImQ/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @vaultnw infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

@vaultnw

188.93.233.96:80

Attributes

auth_value
727d13495c94f0d7fb4ed8453ed74746

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4120-163-0x0000000001210000-0x0000000001238000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

pid	Process
2732	Districts.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 4120	2732	Districts.exe.pif	97

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4880	PING.EXE
1600	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
900	powershell.exe
900	powershell.exe
900	powershell.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
2732	Districts.exe.pif
4120	jsc.exe
4120	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4120	jsc.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1556	4532	Setup.exe	80
PID 4532 wrote to memory of 1556	4532	Setup.exe	80
PID 4532 wrote to memory of 1556	4532	Setup.exe	80
PID 4532 wrote to memory of 4320	4532	Setup.exe	82
PID 4532 wrote to memory of 4320	4532	Setup.exe	82
PID 4532 wrote to memory of 4320	4532	Setup.exe	82
PID 4320 wrote to memory of 3516	4320	cmd.exe	84
PID 4320 wrote to memory of 3516	4320	cmd.exe	84
PID 4320 wrote to memory of 3516	4320	cmd.exe	84
PID 3516 wrote to memory of 900	3516	cmd.exe	85
PID 3516 wrote to memory of 900	3516	cmd.exe	85
PID 3516 wrote to memory of 900	3516	cmd.exe	85
PID 3516 wrote to memory of 4132	3516	cmd.exe	86
PID 3516 wrote to memory of 4132	3516	cmd.exe	86
PID 3516 wrote to memory of 4132	3516	cmd.exe	86
PID 3516 wrote to memory of 3144	3516	cmd.exe	87
PID 3516 wrote to memory of 3144	3516	cmd.exe	87
PID 3516 wrote to memory of 3144	3516	cmd.exe	87
PID 3516 wrote to memory of 2732	3516	cmd.exe	90
PID 3516 wrote to memory of 2732	3516	cmd.exe	90
PID 3516 wrote to memory of 2732	3516	cmd.exe	90
PID 3516 wrote to memory of 4880	3516	cmd.exe	91
PID 3516 wrote to memory of 4880	3516	cmd.exe	91
PID 3516 wrote to memory of 4880	3516	cmd.exe	91
PID 4320 wrote to memory of 1600	4320	cmd.exe	94
PID 4320 wrote to memory of 1600	4320	cmd.exe	94
PID 4320 wrote to memory of 1600	4320	cmd.exe	94
PID 2732 wrote to memory of 4120	2732	Districts.exe.pif	97
PID 2732 wrote to memory of 4120	2732	Districts.exe.pif	97
PID 2732 wrote to memory of 4120	2732	Districts.exe.pif	97
PID 2732 wrote to memory of 4120	2732	Districts.exe.pif	97
PID 2732 wrote to memory of 4120	2732	Districts.exe.pif	97

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup /?
  2⤵
  PID:1556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Sized.hopp & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell get-process avastui
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:900
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell get-process avgui
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4132
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^697641659361031014283292875432934134803066879348275451251687622854791721132842464736768309433644413565856533951022400$" Equivalent.hopp
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Districts.exe.pif
      Districts.exe.pif D
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4120
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:4880
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 bc02215d07db8e929d4d00d60994db835d1aea45a8ebbef6f53e9210a8468c6a
MD5 b6660e1106df0ccf9b67b046beccbaa5
SHA1 a9dda15ff5682d756b92cf9625920344eae10d97
SHA512 b0e2ed6b91b84eae91ea44d90bab190940483e976411332f09969b9eafccd5a034e802b84bcb17be3cdea58f3cf0eaef47b4e1e6fbbc8c68f9e3697b06f4d0c6
SSDEEP 384:Orf+JWP9i+HPLGVo+BJk+o9oYrTrK6seYCME/Ki3KQGm+Vo3NEyvn3QVFDy36:cfPLDEAjoYrTrNhrpKIj9EygVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Districts.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Districts.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Districts.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Districts.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Equivalent.hopp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Equivalent.hopp
Size 925KB
SHA256 b0e99893d3cb9b16fb748e4d497ab66fd67520e1526649b76db62efe70ef4f6e
MD5 817d04e8db00e6067753fc77b049f222
SHA1 2bda47492b9e9d66b61a61ecccec8283b0059383
SHA512 05e8655a6e9cfa437d1f8c45ab428aa6e9c61f32521e87ffbe87d6a145b89fd7b03cd544d960fa48da8fe947a1eda61a81e1142f3fb356ebcdf68a9c961137dd
SSDEEP 24576:9YgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:937+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protocol.hopp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Protocol.hopp
Size 1.1MB
SHA256 0385b15138665f8b58f076cdabc1eaac1f7578c3dd21324f8eb7f086c2cb4886
MD5 cda064b7878140a178c2a31eb2b2a2fc
SHA1 c92bc85e7756e6a44d262f235f0bb489178a61a3
SHA512 97331271c8d3f585de9ad66f5f17de7720532b302df74c30eb81ee6633c8c45a4120c0b0dd1e0bab89cba9243759196bfbe1a65abf2a895bc2452ccdaa4c45dd
SSDEEP 12288:V3jvibipi8DKgaWLb5+QcQDQEcU8elSVcFWrvmI+BKN446rc:VTKgQelSVcF+vxdx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sized.hopp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sized.hopp
Size 11KB
SHA256 9971f44eeb5cb8d764adb0f7150ea39ab06f37817849f86246be95a49b70356a
MD5 166bfea2bcb08a2c7d0605d8b85ad7ad
SHA1 545b1c83bfc433449ad3a9e7cc2b8b9d7ad4f188
SHA512 d878405ed25986f01927e8e0780513bf34540980f0b999f1213e00472ec8e32995c72a9507d88a237988cd5c514dae7643de0d4c94e74ba4293a987bb011407d
SSDEEP 192:LaQcMhOGg4erxag02e2EyXXv1561OBcWRm+kYPMueX2IJce6Fe+0/2S++7+O:OQTO1xD024yXXvHrnnk7XHJce6Fe+0E+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtqLrdymZiIS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jtqLrdymZiIS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/900-137-0x0000000002320000-0x0000000002356000-memory.dmp

Download

memory/900-145-0x00000000061B0000-0x00000000061D2000-memory.dmp

Download

memory/900-144-0x0000000006160000-0x000000000617A000-memory.dmp

Download

memory/900-142-0x0000000005C60000-0x0000000005C7E000-memory.dmp

Download

memory/900-143-0x0000000006E10000-0x0000000006EA6000-memory.dmp

Download

memory/900-140-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/900-139-0x0000000004CA0000-0x0000000004CC2000-memory.dmp

Download

memory/900-141-0x00000000054E0000-0x0000000005546000-memory.dmp

Download

memory/900-138-0x0000000004D40000-0x0000000005368000-memory.dmp

Download

memory/900-146-0x0000000007460000-0x0000000007A04000-memory.dmp

Download

memory/4120-169-0x00000000056C0000-0x00000000056D2000-memory.dmp

Download

memory/4120-167-0x0000000005C20000-0x0000000006238000-memory.dmp

Download

memory/4120-168-0x0000000005790000-0x000000000589A000-memory.dmp

Download

memory/4120-163-0x0000000001210000-0x0000000001238000-memory.dmp

Download

memory/4120-170-0x0000000005720000-0x000000000575C000-memory.dmp

Download

memory/4120-171-0x0000000006BD0000-0x0000000006C62000-memory.dmp

Download

memory/4120-172-0x00000000084C0000-0x0000000008682000-memory.dmp

Download

memory/4120-173-0x0000000008BC0000-0x00000000090EC000-memory.dmp

Download