redline | 3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3

Analysis

max time kernel
206s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe
Size

2.4MB
MD5

87bd5a17b44f7596e7c51dc18d5e512a
SHA1

5e4b5e5310fd399513c4e718a374f716d4a2aae9
SHA256

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3
SHA512

7cd5b7b1dff4ab64aa5331af73e345cbcb3a1e9b7d718bd8d91986b7c2d7bbc96deb97c47eb119b1662632e5be37cc70c896aed704bba34a83c4629e85690100
SSDEEP

49152:35HgdzzCYIDYQlJqCHKaN7pjHLV4mN5sbSjsen0X6tIO:35Ad3QNDKgV4W9jJ0X6b

Score

10^/10

redline main evasion infostealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

main

185.180.231.94:3214

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3576-136-0x0000000000380000-0x00000000009F4000-memory.dmp	family_redline
behavioral2/memory/3576-137-0x0000000000380000-0x00000000009F4000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3576-136-0x0000000000380000-0x00000000009F4000-memory.dmp	themida
behavioral2/memory/3576-137-0x0000000000380000-0x00000000009F4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

pid process

3576 3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description pid process

Token: SeDebugPrivilege 3576 3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

pid	process
3576	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

description	pid	process
Token: SeDebugPrivilege	3576	3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe

C:\Users\Admin\AppData\Local\Temp\3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe
"C:\Users\Admin\AppData\Local\Temp\3889fb0984883bfa7159ba2d8693194120d5e80e0673ca6e5950fdda54dae3e3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-132-0x0000000000380000-0x00000000009F4000-memory.dmp

Filesize
6.5MB

Download
memory/3576-133-0x0000000077A30000-0x0000000077BD3000-memory.dmp

Filesize
1.6MB

Download
memory/3576-136-0x0000000000380000-0x00000000009F4000-memory.dmp

Filesize
6.5MB

Download
memory/3576-137-0x0000000000380000-0x00000000009F4000-memory.dmp

Filesize
6.5MB

Download
memory/3576-138-0x0000000005B40000-0x0000000005BB6000-memory.dmp

Filesize
472KB

Download
memory/3576-139-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/3576-140-0x0000000006220000-0x0000000006838000-memory.dmp

Filesize
6.1MB

Download
memory/3576-141-0x0000000005CB0000-0x0000000005CC2000-memory.dmp

Filesize
72KB

Download
memory/3576-142-0x0000000005D10000-0x0000000005D4C000-memory.dmp

Filesize
240KB

Download
memory/3576-143-0x0000000000380000-0x00000000009F4000-memory.dmp

Filesize
6.5MB

Download
memory/3576-144-0x0000000077A30000-0x0000000077BD3000-memory.dmp

Filesize
1.6MB

Download
memory/3576-145-0x0000000006950000-0x0000000006A5A000-memory.dmp

Filesize
1.0MB

Download