redline | b11d5db5b23557327b0b40d1ea086ec4dc0ce3b52fdf61b3ed1d897016a73a80

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/12/2022, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample221215-xbrmaada85
SHA256 b11d5db5b23557327b0b40d1ea086ec4dc0ce3b52fdf61b3ed1d897016a73a80
MD5 06cfcce8c057dfb9fa974c0c39a82b45
SHA1 3f447228b122c3c80788af4bb67df66cfeaee947
SHA512 d359ac78f6bb0a7c59feccd6b4a222452a5a117738aa8552ccc60e27b7976dc76b664931c30261cba791b84b4a9c0308004e977da26c5a56a1e48c729080522c
SSDEEP 24576:0NA3R5drX/W97xfDfQKOuga8luPvup+r4IdEHSTQ/kTNXSqXg6enhgWZEeoor0C5:V5O7Oda8lnp+rHk/YNXJehSeoor8xtqn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4912	123.exe
4868	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4224	4912	123.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2700	4912	WerFault.exe	81
960	4868	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	vbc.exe
4224	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	vbc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4912	3316	file.exe	81
PID 3316 wrote to memory of 4912	3316	file.exe	81
PID 3316 wrote to memory of 4912	3316	file.exe	81
PID 3316 wrote to memory of 4868	3316	file.exe	84
PID 3316 wrote to memory of 4868	3316	file.exe	84
PID 3316 wrote to memory of 4868	3316	file.exe	84
PID 4912 wrote to memory of 4224	4912	123.exe	85
PID 4912 wrote to memory of 4224	4912	123.exe	85
PID 4912 wrote to memory of 4224	4912	123.exe	85
PID 4912 wrote to memory of 4224	4912	123.exe	85
PID 4912 wrote to memory of 4224	4912	123.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 500
    3⤵
    - Program crash
    PID:2700
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 732
    3⤵
    - Program crash
    PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4912 -ip 4912
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4868 -ip 4868
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Windows\Temp\123.exe
Size 286KB
SHA256 e746380d13887bd0952977d7743780411df5aa3bdadbfcd86413c8d6a0e3b365
MD5 0cec8131f7c93d4ec73a76a88219fc79
SHA1 79876c8ad480aa2f21d22c5b04761e59cbbd3c28
SHA512 dfd5cbb75dfdef355e9ef967026adea2e1b80a6bff42a55defe174ba5a47a0c2c87487dee28da8a9a6ef662cd891b48026f8b85b09657d8520f91d7ff4264974
SSDEEP 6144:c/1IYkT5y6LiHq7a/kvtJNd7dzcaADQGmi82MdkClUP:cNIYkT9hFJ37dzcLfmi8XdkCmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 286KB
SHA256 e746380d13887bd0952977d7743780411df5aa3bdadbfcd86413c8d6a0e3b365
MD5 0cec8131f7c93d4ec73a76a88219fc79
SHA1 79876c8ad480aa2f21d22c5b04761e59cbbd3c28
SHA512 dfd5cbb75dfdef355e9ef967026adea2e1b80a6bff42a55defe174ba5a47a0c2c87487dee28da8a9a6ef662cd891b48026f8b85b09657d8520f91d7ff4264974
SSDEEP 6144:c/1IYkT5y6LiHq7a/kvtJNd7dzcaADQGmi82MdkClUP:cNIYkT9hFJ37dzcLfmi8XdkCmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.5MB
SHA256 f7832e4255fb8717ce7066f6961d1e97c99bc4e6bf98044ee704fbdc1c2252e7
MD5 06d63501a1dff2ad2da9018e92582f4c
SHA1 ca4bf2c4fe0b2e4e9b031af0a689484bf9a18d54
SHA512 19ab4c9ca3091bdbd99b78e315f328ddbe692bb4531ce42a8c410db8b0b3be51ee747454cd15123b390a52b71c7cda1b821fbee0d42d94c0c1f8ab7f4d4c0828
SSDEEP 49152:b4YqXr+WeDC+dam3cecAOjG6EZ6XxnfjL/QyVV0/aBtnK9iiSaSwdkIC8KiPiU:b4Yq7+WeddtHcAOEZEHLV0/aBtnKfSat
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4224-144-0x00000000057B0000-0x00000000058BA000-memory.dmp

Download

memory/4224-146-0x0000000005740000-0x000000000577C000-memory.dmp

Download

memory/4224-138-0x0000000001100000-0x0000000001132000-memory.dmp

Download

memory/4224-143-0x0000000005C30000-0x0000000006248000-memory.dmp

Download

memory/4224-153-0x0000000006970000-0x00000000069C0000-memory.dmp

Download

memory/4224-145-0x00000000056E0000-0x00000000056F2000-memory.dmp

Download

memory/4224-152-0x0000000007420000-0x0000000007496000-memory.dmp

Download

memory/4224-147-0x0000000001580000-0x0000000001612000-memory.dmp

Download

memory/4224-148-0x0000000006A00000-0x0000000006FA4000-memory.dmp

Download

memory/4224-149-0x0000000006450000-0x00000000064B6000-memory.dmp

Download

memory/4224-150-0x0000000006FB0000-0x0000000007172000-memory.dmp

Download

memory/4224-151-0x00000000076B0000-0x0000000007BDC000-memory.dmp

Download