redline | 3aa2686dba9ad329e0e2da3f76a29161bdc6deab36422b5854838e3afd4ea916

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2022, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample221227-rf4jraab7x
SHA256 3aa2686dba9ad329e0e2da3f76a29161bdc6deab36422b5854838e3afd4ea916
MD5 186c9341f36ad552a2a17ea9903eab12
SHA1 510968658d13c4e872eb6bc359e454c7f6b6dfab
SHA512 6d1bea1f62d64b7de20539bc0cb5eacb103d476ab5a9195169f3c175b8aa3be963747561782f677e288224b85b36f421fb155879ba6eee8937e871c624f3e539
SSDEEP 49152:V5OO/l4x/kByJ4g3AVm5c3+12bk7vRDB3VwMylYZRr:V5i8W4wAycuQbk1FFwvY/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4756	123.exe
1704	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	file.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 1748	4756	123.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	4756	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	vbc.exe
1748	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4756	2112	file.exe	82
PID 2112 wrote to memory of 4756	2112	file.exe	82
PID 2112 wrote to memory of 4756	2112	file.exe	82
PID 2112 wrote to memory of 1704	2112	file.exe	85
PID 2112 wrote to memory of 1704	2112	file.exe	85
PID 2112 wrote to memory of 1704	2112	file.exe	85
PID 1704 wrote to memory of 5024	1704	321.exe	86
PID 1704 wrote to memory of 5024	1704	321.exe	86
PID 1704 wrote to memory of 5024	1704	321.exe	86
PID 4756 wrote to memory of 1748	4756	123.exe	88
PID 4756 wrote to memory of 1748	4756	123.exe	88
PID 4756 wrote to memory of 1748	4756	123.exe	88
PID 4756 wrote to memory of 1748	4756	123.exe	88
PID 4756 wrote to memory of 1748	4756	123.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 256
    3⤵
    - Program crash
    PID:5028
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
    3⤵
    PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4756 -ip 4756
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bebra.exe

Path C:\Users\Admin\AppData\Roaming\bebra.exe
Size 5B
SHA256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
MD5 8b1a9953c4611296a827abf8c47804d7
SHA1 f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA512 3615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
MD5 SHA1 SHA512

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 397KB
SHA256 869546647c04581b962b35cb7b8e337a7b4b4c0476795805b07589431d71826d
MD5 13f915155ed5f9206c336a5d72fcfdb9
SHA1 8518138054e87bd3050828b5b2ee2b729933ea85
SHA512 85b823a8bed1a502778d54513a9926bc27fc3986d655684d9dd6ede314243bcc6079ab0c55c98b44b3ef7574f6dd7e831074d6962e26abdca31df5d53473be8b
SSDEEP 6144:t+hp0xIyuQ3QTprP30jUISJTfAOCZGSa:tip0xIyuQgV189a
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 397KB
SHA256 869546647c04581b962b35cb7b8e337a7b4b4c0476795805b07589431d71826d
MD5 13f915155ed5f9206c336a5d72fcfdb9
SHA1 8518138054e87bd3050828b5b2ee2b729933ea85
SHA512 85b823a8bed1a502778d54513a9926bc27fc3986d655684d9dd6ede314243bcc6079ab0c55c98b44b3ef7574f6dd7e831074d6962e26abdca31df5d53473be8b
SSDEEP 6144:t+hp0xIyuQ3QTprP30jUISJTfAOCZGSa:tip0xIyuQgV189a
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1748-151-0x0000000005380000-0x00000000053E6000-memory.dmp

Download

memory/1748-148-0x0000000004F80000-0x0000000004FBC000-memory.dmp

Download

memory/1748-140-0x0000000000390000-0x00000000003C2000-memory.dmp

Download

memory/1748-145-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Download

memory/1748-146-0x0000000004FF0000-0x00000000050FA000-memory.dmp

Download

memory/1748-147-0x0000000004F20000-0x0000000004F32000-memory.dmp

Download

memory/1748-155-0x0000000007CF0000-0x000000000821C000-memory.dmp

Download

memory/1748-149-0x00000000052E0000-0x0000000005372000-memory.dmp

Download

memory/1748-150-0x0000000006090000-0x0000000006634000-memory.dmp

Download

memory/1748-154-0x00000000075F0000-0x00000000077B2000-memory.dmp

Download

memory/1748-152-0x0000000005F60000-0x0000000005FD6000-memory.dmp

Download

memory/1748-153-0x0000000005FE0000-0x0000000006030000-memory.dmp

Download