redline | 787604212120703df96b630a7a66041622ca5ff07f604ad5545685e3e0b4d5ed

General

Target

applicationsetup.exe
Size

550.0MB
MD5

53d777239c457304f3d48f7f8392a3c0
SHA1

1b6190b8f6bbb1e43b5f401a5c290f46f4fcc16f
SHA256

b0131f3937eb232a8a1d00db4bd33b7edb74edf04d864f185520a1340fad4b38
SHA512

2950bdd6fcacda31a1510f6a78e5dd24c10f5ed68c2fc7693923f0407ce88040d1af8056d7f8aa8a1c34cab0d2d1c2cfdb61ee8221dd12ce1f657f2c07702423
SSDEEP

24576:EPbJIaHB3lCH6RmGNsSMyBe0KWCQKUKc4uEsZJIaHB3lCH6RmGNsSMyBe0KWCQzt:EPlIAfRtsSpYs/KtWXIAfRtsSpYsx

Score

10^/10

redline 171222_youtube agilenet infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

171222_youtube

C2

metamastif.makelogs.org:10737

Attributes

auth_value
0740cb4da2a0ce79c20f4b6ff7797a56

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4756-132-0x00000000001E0000-0x0000000000312000-memory.dmp	agile_net

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

Processes:

powershell.exe

pid	process
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4356 set thread context of 992 4356 powershell.exe aspnet_compiler.exe

description	pid	process	target process
PID 4356 set thread context of 992	4356	powershell.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	process
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeaspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 4356 powershell.exe
Token: SeDebugPrivilege 992 aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	992	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

applicationsetup.exepowershell.exe

description	pid	process	target process
PID 4756 wrote to memory of 4356	4756	applicationsetup.exe	powershell.exe
PID 4756 wrote to memory of 4356	4756	applicationsetup.exe	powershell.exe
PID 4756 wrote to memory of 4356	4756	applicationsetup.exe	powershell.exe
PID 4356 wrote to memory of 1284	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 1284	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 1284	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe
PID 4356 wrote to memory of 992	4356	powershell.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\applicationsetup.exe
"C:\Users\Admin\AppData\Local\Temp\applicationsetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
PID:1284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-156-0x00000000066A0000-0x00000000066BE000-memory.dmp

Filesize
120KB

Download
memory/992-155-0x0000000006DE0000-0x000000000730C000-memory.dmp

Filesize
5.2MB

Download
memory/992-154-0x00000000066E0000-0x00000000068A2000-memory.dmp

Filesize
1.8MB

Download
memory/992-153-0x0000000004E70000-0x0000000004EAC000-memory.dmp

Filesize
240KB

Download
memory/992-152-0x0000000004F10000-0x000000000501A000-memory.dmp

Filesize
1.0MB

Download
memory/992-151-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/992-150-0x0000000005390000-0x00000000059A8000-memory.dmp

Filesize
6.1MB

Download
memory/992-149-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/992-148-0x0000000000000000-mapping.dmp

Download
memory/1284-147-0x0000000000000000-mapping.dmp

Download
memory/4356-138-0x0000000005030000-0x0000000005658000-memory.dmp

Filesize
6.2MB

Download
memory/4356-140-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/4356-144-0x0000000007160000-0x00000000071D6000-memory.dmp

Filesize
472KB

Download
memory/4356-145-0x0000000007860000-0x0000000007EDA000-memory.dmp

Filesize
6.5MB

Download
memory/4356-146-0x0000000007120000-0x000000000713A000-memory.dmp

Filesize
104KB

Download
memory/4356-142-0x0000000005E20000-0x0000000005E3E000-memory.dmp

Filesize
120KB

Download
memory/4356-141-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/4356-143-0x0000000006380000-0x00000000063C4000-memory.dmp

Filesize
272KB

Download
memory/4356-139-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Filesize
136KB

Download
memory/4356-136-0x0000000000000000-mapping.dmp

Download
memory/4356-137-0x0000000004840000-0x0000000004876000-memory.dmp

Filesize
216KB

Download
memory/4756-132-0x00000000001E0000-0x0000000000312000-memory.dmp

Filesize
1.2MB

Download
memory/4756-135-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Filesize
40KB

Download
memory/4756-134-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Filesize
584KB

Download
memory/4756-133-0x0000000005230000-0x00000000057D4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads