redline | a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445

Analysis

max time kernel
60s
max time network
180s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
06-12-2022 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
Size

2.8MB
MD5

31a9a8c6d1d79fc6afdd9a5c991188f1
SHA1

d294e06685c76d32338585564ebe9c4ff49dd067
SHA256

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445
SHA512

48e8d0a33ba514106fa95f1e8e2fdfb74083de0c2434b3d3bbb716cc8a78a66ee657044dd36b70291ce369ba75624f977560c32a5a96cefe7ee54a92f5e5500a
SSDEEP

49152:crvnXYyaoU7Efzua3KIVouFK+hByJPD6hXlunD3tzQ:crvnnUIfzD37FlW1QVm9E

Score

10^/10

redline 0512 infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

0512

81.161.229.143:26910

Attributes

auth_value
c020923553bd23ba826df75b6d76d4de

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/536-243-0x000000000045B05E-mapping.dmp	family_redline
behavioral2/memory/536-276-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

5150725674.exe

pid process

3328 5150725674.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3328	5150725674.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe

description	pid	process	target process
PID 1304 set thread context of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exeInstallUtil.exe

pid	process
1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
536	InstallUtil.exe
536	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
Token: SeDebugPrivilege	536	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe

description	pid	process	target process
PID 1304 wrote to memory of 3328	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 1304 wrote to memory of 3328	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 1304 wrote to memory of 3328	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 1304 wrote to memory of 536	1304	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
"C:\Users\Admin\AppData\Local\Temp\a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe"
2⤵
- Executes dropped EXE
PID:3328

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe
Filesize
2.5MB

MD5
94b7f381f92902712b845c2113b14d93

SHA1
9af6129d6e1200aece810cb369e0295f5bcffec0

SHA256
262d5cb04240f682b0dd872be29f7c7e2a9913934f08e341695524a38d56fc37

SHA512
da98600b847fb9769131b999f7c87d75e71f4b48334145877e9f61c973c5d3a11d83bfc1b3bb76df8da60ac12cb03a7c76ffb3a0bae55e4425884df25077b2ee

Download Submit
memory/536-243-0x000000000045B05E-mapping.dmp

Download
memory/536-276-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/536-283-0x00000000056D0000-0x00000000056D6000-memory.dmp

Filesize
24KB

Download
memory/536-329-0x000000000D780000-0x000000000DCAC000-memory.dmp

Filesize
5.2MB

Download
memory/536-328-0x000000000C7F0000-0x000000000C9B2000-memory.dmp

Filesize
1.8MB

Download
memory/536-326-0x000000000D1D0000-0x000000000D246000-memory.dmp

Filesize
472KB

Download
memory/536-327-0x000000000C470000-0x000000000C4C0000-memory.dmp

Filesize
320KB

Download
memory/536-315-0x000000000B220000-0x000000000B286000-memory.dmp

Filesize
408KB

Download
memory/536-309-0x000000000AFB0000-0x000000000AFFB000-memory.dmp

Filesize
300KB

Download
memory/536-307-0x000000000AE30000-0x000000000AE6E000-memory.dmp

Filesize
248KB

Download
memory/536-305-0x000000000ADD0000-0x000000000ADE2000-memory.dmp

Filesize
72KB

Download
memory/536-303-0x000000000AEA0000-0x000000000AFAA000-memory.dmp

Filesize
1.0MB

Download
memory/536-302-0x000000000B310000-0x000000000B916000-memory.dmp

Filesize
6.0MB

Download
memory/1304-160-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/1304-167-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-132-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-133-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-134-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-135-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-136-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-137-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-139-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-138-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-140-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-141-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-142-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-143-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-144-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-145-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-146-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-147-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-148-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-149-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-150-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-151-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-152-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-153-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-154-0x0000000000BD0000-0x0000000000EA4000-memory.dmp

Filesize
2.8MB

Download
memory/1304-155-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-156-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-157-0x0000000005E20000-0x000000000631E000-memory.dmp

Filesize
5.0MB

Download
memory/1304-158-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-159-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/1304-130-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-161-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-162-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-163-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-164-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-165-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-166-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-131-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-168-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-169-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-170-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-171-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-172-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-173-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-174-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-175-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-176-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-177-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-178-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-179-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-180-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-181-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-182-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-183-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-184-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-185-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-186-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-187-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-202-0x0000000006860000-0x0000000006890000-memory.dmp

Filesize
192KB

Download
memory/1304-205-0x0000000006A70000-0x0000000006A7A000-memory.dmp

Filesize
40KB

Download
memory/1304-129-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-128-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-127-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-126-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-125-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-124-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-123-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-122-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-121-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-120-0x0000000077D10000-0x0000000077E9E000-memory.dmp

Filesize
1.6MB

Download
memory/1304-209-0x0000000008880000-0x0000000008898000-memory.dmp

Filesize
96KB

Download
memory/1304-240-0x0000000003050000-0x000000000306A000-memory.dmp

Filesize
104KB

Download
memory/1304-241-0x0000000003080000-0x0000000003086000-memory.dmp

Filesize
24KB

Download
memory/3328-219-0x0000000000000000-mapping.dmp

Download