redline | a2766924130f9f5c19eeee078f29d1073c89734cb570775f67d70a95ef6dea1d

Resubmissions

26-11-2022 03:27

221126-dzv5tshc68 7

26-11-2022 03:23

221126-dxxwmscd6w 10

Analysis

max time kernel
64s
max time network
92s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sоnic Frоntiеrs Sеtuр/Sоnic Frоntiеrs Sеtuр.exe
Size

763.6MB
MD5

1c3cf682c253a5a931a7de2e4be5e67e
SHA1

73ac7ba407fc95d0b7121eb0e9499dfbdf3ccdbc
SHA256

0ac69838b494dae7b4f64531ad20068d3b66b193858bbf1b4bfcb4e19417714a
SHA512

9ed28350ade2b5f07e8efb561563223115527e37c8e656e824fe800bbd99fe4395bc2e76e6441341fe11b8480aed9c72501a1e6bec0cd62b027a73d254816c98
SSDEEP

98304:lrl9Mjm6TJse6CiowYIHYLBlrqTaXEV/61IujIAnNu/ppEPlYMr:Nl9Km6TJH6TYI8BlrOki/d7AnmgPlB

Score

10^/10

redline @cham1ng infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@cham1ng

193.106.191.160:8673

Attributes

auth_value
296c18e34d670ae41d67c9e09e2546b7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral15/memory/95972-60-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral15/memory/95972-65-0x0000000000422196-mapping.dmp	family_redline
behavioral15/memory/95972-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral15/memory/95972-67-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral15/memory/952-70-0x0000000000400000-0x0000000000D19000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sоnic Frоntiеrs Sеtuр.exe

description pid process target process

PID 952 set thread context of 95972 952 Sоnic Frоntiеrs Sеtuр.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

96012 952 WerFault.exe Sоnic Frоntiеrs Sеtuр.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Sоnic Frоntiеrs Sеtuр.exeAppLaunch.exe

pid process

952 Sоnic Frоntiеrs Sеtuр.exe
95972 AppLaunch.exe
95972 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 95972 AppLaunch.exe

description	pid	process	target process
PID 952 set thread context of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe

pid	pid_target	process	target process
96012	952	WerFault.exe	Sоnic Frоntiеrs Sеtuр.exe

pid	process
952	Sоnic Frоntiеrs Sеtuр.exe
95972	AppLaunch.exe
95972	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	95972	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Sоnic Frоntiеrs Sеtuр.exe

description	pid	process	target process
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 95972	952	Sоnic Frоntiеrs Sеtuр.exe	AppLaunch.exe
PID 952 wrote to memory of 96012	952	Sоnic Frоntiеrs Sеtuр.exe	WerFault.exe
PID 952 wrote to memory of 96012	952	Sоnic Frоntiеrs Sеtuр.exe	WerFault.exe
PID 952 wrote to memory of 96012	952	Sоnic Frоntiеrs Sеtuр.exe	WerFault.exe
PID 952 wrote to memory of 96012	952	Sоnic Frоntiеrs Sеtuр.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Sоnic Frоntiеrs Sеtuр\Sоnic Frоntiеrs Sеtuр.exe
"C:\Users\Admin\AppData\Local\Temp\Sоnic Frоntiеrs Sеtuр\Sоnic Frоntiеrs Sеtuр.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:95972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 94652
2⤵
- Program crash
PID:96012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-54-0x0000000000400000-0x0000000000D19000-memory.dmp

Filesize
9.1MB

Download
memory/952-57-0x0000000000400000-0x0000000000D19000-memory.dmp

Filesize
9.1MB

Download
memory/952-70-0x0000000000400000-0x0000000000D19000-memory.dmp

Filesize
9.1MB

Download
memory/95972-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95972-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95972-65-0x0000000000422196-mapping.dmp

Download
memory/95972-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95972-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/95972-69-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/96012-68-0x0000000000000000-mapping.dmp

Download