redline | 6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.8MB
Sample221229-qrtm9adb39
SHA256 6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34
MD5 930b74d8b5b2c43f475909927a23f9c5
SHA1 59fe8b73bcd6608cd64c86ecdce04bd3f22e1d4b
SHA512 01d7041db785b90edfd8e3f9b69be00b73a0feb6b3c2146c3dcc89cf1c45f239d1e7ce3b94ffe4eb33adccdf9b672aba3d6dbf7ee8d783a5e7383526b2100cb4
SSDEEP 49152:V5OQNTS2/kByJ4g3AVm5c3+12bk7vRDB3VwMylYZRn:V5ZFSzW4wAycuQbk1FFwvYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1136	123.exe
4104	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	file.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 4276	1136	123.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	1136	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4276	vbc.exe
4276	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1136	2412	file.exe	80
PID 2412 wrote to memory of 1136	2412	file.exe	80
PID 2412 wrote to memory of 1136	2412	file.exe	80
PID 2412 wrote to memory of 4104	2412	file.exe	83
PID 2412 wrote to memory of 4104	2412	file.exe	83
PID 2412 wrote to memory of 4104	2412	file.exe	83
PID 1136 wrote to memory of 4276	1136	123.exe	84
PID 1136 wrote to memory of 4276	1136	123.exe	84
PID 1136 wrote to memory of 4276	1136	123.exe	84
PID 1136 wrote to memory of 4276	1136	123.exe	84
PID 4104 wrote to memory of 3496	4104	321.exe	85
PID 4104 wrote to memory of 3496	4104	321.exe	85
PID 4104 wrote to memory of 3496	4104	321.exe	85
PID 1136 wrote to memory of 4276	1136	123.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 264
    3⤵
    - Program crash
    PID:1856
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
    3⤵
    PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1136 -ip 1136
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bebra.exe

Path C:\Users\Admin\AppData\Roaming\bebra.exe
Size 5B
SHA256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
MD5 8b1a9953c4611296a827abf8c47804d7
SHA1 f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA512 3615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
MD5 SHA1 SHA512

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 356KB
SHA256 aa715baf9a0265037accc36eaf7d60af1619c3757f04cc17c3280c06341c5ed2
MD5 031caa46a6495dba429d165ddecf664a
SHA1 172a307658c2235677e789d9c7432973f492609d
SHA512 105fd9b66d4ac0b4b475c75795f16f51fe965379de20c1fbf23364acec47e9b7e7ff8f3a42c40539f6e5c02d574636c95cba1cf494f200f479cc3b85c121b726
SSDEEP 6144:qcJeNaxNPMRWRBlTywE7AO9PIyOgpvbaRdN28MCi3sBJV:HeNaxxMRsu7oyDg28MCicBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.5MB
SHA256 32a8cd30c365f2e24302b0fce7fdcc6300cbbabb8ffe99247612411774be49b5
MD5 dcfaf070a6a9f794614f015be1a4288d
SHA1 8516855f7202ec5ebf010d30e591149bd249f60e
SHA512 52979a0716f1956f889fa62212ba4923cd869011c190b80679343f01b9d6160cbb1067bbbd281688c7f0936fe5d4304c61854aaa167e0d7f79a9e511f51a80fc
SSDEEP 49152:RWkH63Wj9EcNY6SBNYQ7y8q9tfg/Jh6DJseb8sRClgIx07DhX9cJ8fWsqqWD3bd:RWka3Wj9W33YQ7y3whglWgIx07DncJ8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4276-146-0x00000000056D0000-0x00000000057DA000-memory.dmp

Download

memory/4276-138-0x0000000001000000-0x0000000001032000-memory.dmp

Download

memory/4276-145-0x0000000005BA0000-0x00000000061B8000-memory.dmp

Download

memory/4276-147-0x0000000005600000-0x0000000005612000-memory.dmp

Download

memory/4276-148-0x0000000005670000-0x00000000056AC000-memory.dmp

Download

memory/4276-149-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/4276-150-0x0000000006560000-0x00000000065F2000-memory.dmp

Download

memory/4276-151-0x0000000006BB0000-0x0000000007154000-memory.dmp

Download

memory/4276-152-0x0000000007BC0000-0x0000000007D82000-memory.dmp

Download

memory/4276-153-0x00000000082C0000-0x00000000087EC000-memory.dmp

Download

memory/4276-154-0x0000000006890000-0x0000000006906000-memory.dmp

Download

memory/4276-155-0x0000000006910000-0x0000000006960000-memory.dmp

Download