redline | 4be071e41efa58f0914dcbffc7be24b71978e8535c4f04e2dcf6b30375ff8d6d

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.1MB
Sample230104-rc9llabg2x
SHA256 4be071e41efa58f0914dcbffc7be24b71978e8535c4f04e2dcf6b30375ff8d6d
MD5 e46e130a7265538d87ea40c2afafb07b
SHA1 6da03c77b78cb0182ed1beb9c3702a70c3c16006
SHA512 27c3f65c86f50d896056ec277b58a1788927a27909529b3cd669453b026f027bc0e5dfef703de85db6552391b973ad9c8b3ca320d1df32c10718d03408c49ea9
SSDEEP 49152:V5O2dXVCiNXhbqXH6WM4IgtgqPk/t6N0vY4BNvFjW:V5lXCinbqR5LtgqPk/t6OvYoVW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
3064	123.exe
4488	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	file.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 3028	3064	123.exe	86
PID 4488 set thread context of 2724	4488	321.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4156	3064	WerFault.exe	81
2356	4488	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	vbc.exe
3028	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3064	4884	file.exe	81
PID 4884 wrote to memory of 3064	4884	file.exe	81
PID 4884 wrote to memory of 3064	4884	file.exe	81
PID 4884 wrote to memory of 4488	4884	file.exe	84
PID 4884 wrote to memory of 4488	4884	file.exe	84
PID 4884 wrote to memory of 4488	4884	file.exe	84
PID 3064 wrote to memory of 3028	3064	123.exe	86
PID 3064 wrote to memory of 3028	3064	123.exe	86
PID 3064 wrote to memory of 3028	3064	123.exe	86
PID 3064 wrote to memory of 3028	3064	123.exe	86
PID 3064 wrote to memory of 3028	3064	123.exe	86
PID 4488 wrote to memory of 2724	4488	321.exe	89
PID 4488 wrote to memory of 2724	4488	321.exe	89
PID 4488 wrote to memory of 2724	4488	321.exe	89
PID 4488 wrote to memory of 2724	4488	321.exe	89
PID 4488 wrote to memory of 2724	4488	321.exe	89
PID 2724 wrote to memory of 2840	2724	vbc.exe	92
PID 2724 wrote to memory of 2840	2724	vbc.exe	92
PID 2724 wrote to memory of 2840	2724	vbc.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 252
    3⤵
    - Program crash
    PID:4156
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe\bebra.exe
      4⤵
      PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 240
    3⤵
    - Program crash
    PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3064 -ip 3064
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4488 -ip 4488
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Windows\Temp\123.exe
Size 354KB
SHA256 8d6163e71e9665eb5397cf0d337b5d27a85b9196d94e3b9ad8ca0f224977040d
MD5 e07be76449c34bcdeb541cb637f1f1ac
SHA1 e04484b809811a120e0253ebdd10f53b9d2d1670
SHA512 9aaf26c51912e4ebf4bdbea2195bdad00be94643f3d129c3d42df95e827d8080fea4edf0db95f2a1a40013799327783f1004e5f20fdc30d95c00c76442f5fb5f
SSDEEP 6144:E3xTQhoCIjMzPDJ1lrJJAOKm1hpa01Z7rHoA8Dtnwce6x8xMfbfgOQlbAM21v7FI:0FQh7V1JkcZ7ronSaVAb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 354KB
SHA256 8d6163e71e9665eb5397cf0d337b5d27a85b9196d94e3b9ad8ca0f224977040d
MD5 e07be76449c34bcdeb541cb637f1f1ac
SHA1 e04484b809811a120e0253ebdd10f53b9d2d1670
SHA512 9aaf26c51912e4ebf4bdbea2195bdad00be94643f3d129c3d42df95e827d8080fea4edf0db95f2a1a40013799327783f1004e5f20fdc30d95c00c76442f5fb5f
SSDEEP 6144:E3xTQhoCIjMzPDJ1lrJJAOKm1hpa01Z7rHoA8Dtnwce6x8xMfbfgOQlbAM21v7FI:0FQh7V1JkcZ7ronSaVAb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.7MB
SHA256 80095f1c9212440052416373158c409df9549e110fefbc5c045387753c190fac
MD5 538aa525c836082ca6f03747d0ec9a03
SHA1 63dd91e5cb0cdb8a257589b78208cc7ab19a76d0
SHA512 f155a1c3c4e902156f8a510fdef11952fbaeb8a85935a3356d317e2771b8c9640b6af0b0846fe0259ef07a4c3fd3c8b50f6c37652bc0546daba16b591a204886
SSDEEP 49152:CnKd61zeTfUbMGD7gQ8fq2CXh67j3bKef/5mJpIcLV+s:CKd61zpTcQP9Xh+j3bKef/5mPIo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.7MB
SHA256 80095f1c9212440052416373158c409df9549e110fefbc5c045387753c190fac
MD5 538aa525c836082ca6f03747d0ec9a03
SHA1 63dd91e5cb0cdb8a257589b78208cc7ab19a76d0
SHA512 f155a1c3c4e902156f8a510fdef11952fbaeb8a85935a3356d317e2771b8c9640b6af0b0846fe0259ef07a4c3fd3c8b50f6c37652bc0546daba16b591a204886
SSDEEP 49152:CnKd61zeTfUbMGD7gQ8fq2CXh67j3bKef/5mJpIcLV+s:CKd61zpTcQP9Xh+j3bKef/5mPIo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2724-161-0x0000000001300000-0x000000000158F000-memory.dmp

Download

memory/2724-149-0x0000000001300000-0x000000000158F000-memory.dmp

Download

memory/3028-164-0x0000000006010000-0x00000000065B4000-memory.dmp

Download

memory/3028-165-0x0000000005280000-0x00000000052E6000-memory.dmp

Download

memory/3028-146-0x0000000004EF0000-0x0000000004F02000-memory.dmp

Download

memory/3028-147-0x0000000004F50000-0x0000000004F8C000-memory.dmp

Download

memory/3028-139-0x0000000000A30000-0x0000000000A62000-memory.dmp

Download

memory/3028-145-0x0000000004FC0000-0x00000000050CA000-memory.dmp

Download

memory/3028-163-0x0000000005320000-0x00000000053B2000-memory.dmp

Download

memory/3028-169-0x00000000066C0000-0x0000000006710000-memory.dmp

Download

memory/3028-144-0x0000000005440000-0x0000000005A58000-memory.dmp

Download

memory/3028-168-0x0000000006640000-0x00000000066B6000-memory.dmp

Download

memory/3028-166-0x0000000006790000-0x0000000006952000-memory.dmp

Download

memory/3028-167-0x0000000006E90000-0x00000000073BC000-memory.dmp

Download