redline | 58fd04fe003160c5aca2e839d8588bd86b9a2b3ddcd8e3ddd5616182e9d9c45f

Analysis

max time kernel
148s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 460KB
Sample221202-mtfbvsdd4t
SHA256 58fd04fe003160c5aca2e839d8588bd86b9a2b3ddcd8e3ddd5616182e9d9c45f
MD5 628f92d2f72e354115c37c23c371dfdf
SHA1 b56ba706666fd6d2ed64a3d8ca062ee95c0c1343
SHA512 76874d02452941bd55a1bbbca6d1328c97429029f76e35890fa11c51d4187acbbbb9dac1867c4dd2b11a24ffd1485460513d0b18376cedd406fc60a7e8edac0e
SSDEEP 6144:EkNuTazUksHSAnL5GQpDKzv3XTWjfkz3SGPfppG16uLolTAoelLeyW:EeuTNklAnjVK7XTW4DSG3bGNKAFlLeyW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline install infostealer

Malware Config

Extracted

Family

redline

Botnet

Install

manddarinn.art:81

Attributes

auth_value
f9affed97251c08e7a096257ba9edfb2

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/964-135-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral2/memory/964-136-0x0000000000422182-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 964	4068	file.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4068	file.exe
4068	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1260	4068	file.exe	82
PID 4068 wrote to memory of 1260	4068	file.exe	82
PID 4068 wrote to memory of 1260	4068	file.exe	82
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83
PID 4068 wrote to memory of 964	4068	file.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-135-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/964-138-0x0000000005CC0000-0x00000000062D8000-memory.dmp

Download

memory/964-139-0x0000000005840000-0x000000000594A000-memory.dmp

Download

memory/964-140-0x0000000005790000-0x00000000057A2000-memory.dmp

Download

memory/964-141-0x00000000057F0000-0x000000000582C000-memory.dmp

Download

memory/4068-132-0x000002A256010000-0x000002A256086000-memory.dmp

Download

memory/4068-133-0x00007FFD8CD00000-0x00007FFD8D7C1000-memory.dmp

Download

memory/4068-134-0x00007FFD8CD00000-0x00007FFD8D7C1000-memory.dmp

Download

memory/4068-137-0x00007FFD8CD00000-0x00007FFD8D7C1000-memory.dmp

Download