redline | 6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample221229-qrtm9adb39
SHA256 6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34
MD5 930b74d8b5b2c43f475909927a23f9c5
SHA1 59fe8b73bcd6608cd64c86ecdce04bd3f22e1d4b
SHA512 01d7041db785b90edfd8e3f9b69be00b73a0feb6b3c2146c3dcc89cf1c45f239d1e7ce3b94ffe4eb33adccdf9b672aba3d6dbf7ee8d783a5e7383526b2100cb4
SSDEEP 49152:V5OQNTS2/kByJ4g3AVm5c3+12bk7vRDB3VwMylYZRn:V5ZFSzW4wAycuQbk1FFwvYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1328	123.exe
1008	321.exe

Loads dropped DLL 10 IoCs

pid	Process
308	file.exe
308	file.exe
308	file.exe
308	file.exe
308	file.exe
308	file.exe
308	file.exe
1372	WerFault.exe
1372	WerFault.exe
1372	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1328 set thread context of 808	1328	123.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	1328	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
808	vbc.exe
808	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	vbc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1328	308	file.exe	28
PID 308 wrote to memory of 1328	308	file.exe	28
PID 308 wrote to memory of 1328	308	file.exe	28
PID 308 wrote to memory of 1328	308	file.exe	28
PID 308 wrote to memory of 1008	308	file.exe	30
PID 308 wrote to memory of 1008	308	file.exe	30
PID 308 wrote to memory of 1008	308	file.exe	30
PID 308 wrote to memory of 1008	308	file.exe	30
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 808	1328	123.exe	31
PID 1328 wrote to memory of 1372	1328	123.exe	32
PID 1328 wrote to memory of 1372	1328	123.exe	32
PID 1328 wrote to memory of 1372	1328	123.exe	32
PID 1328 wrote to memory of 1372	1328	123.exe	32
PID 1008 wrote to memory of 920	1008	321.exe	33
PID 1008 wrote to memory of 920	1008	321.exe	33
PID 1008 wrote to memory of 920	1008	321.exe	33
PID 1008 wrote to memory of 920	1008	321.exe	33

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 48
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1372
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
    3⤵
    PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/308-54-0x0000000075671000-0x0000000075673000-memory.dmp

Download

memory/808-68-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/808-66-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/808-74-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/808-75-0x0000000000400000-0x0000000000432000-memory.dmp

Download