redline | a88de17a29eaaaab996f32b4ddb579d5930b7d1f152bfb10018481e2b5612d70

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.1MB
Sample230113-q6d64shd23
SHA256 a88de17a29eaaaab996f32b4ddb579d5930b7d1f152bfb10018481e2b5612d70
MD5 31989a60648d81e2b1692bf5ee6807b7
SHA1 3bccd5583b0bb864b1473f43940ca1cdf87142c4
SHA512 99b2d0cde5f9f2124842a45851b4273ffb230616568376e3aeebd98dbabf20170e31a622233a23ee0e7de6d1fa0aae70f35a2e790ee89197ba17bbdfdb62ddd6
SSDEEP 49152:V5OMhQHLK7nxP07X/cR9iTTt2NEsSB9IVh+0Y:V5wsP0j/cRUvtsEZB9IjY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1968	123.exe
1112	321.exe

Loads dropped DLL 12 IoCs

pid	Process
2008	file.exe
2008	file.exe
2008	file.exe
2008	file.exe
2008	file.exe
2008	file.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
960	WerFault.exe
960	WerFault.exe
960	WerFault.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 1068	1968	123.exe	31
PID 1112 set thread context of 1664	1112	321.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1560	1968	WerFault.exe	27
960	1112	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	vbc.exe
1068	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	vbc.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1968	2008	file.exe	27
PID 2008 wrote to memory of 1968	2008	file.exe	27
PID 2008 wrote to memory of 1968	2008	file.exe	27
PID 2008 wrote to memory of 1968	2008	file.exe	27
PID 2008 wrote to memory of 1112	2008	file.exe	29
PID 2008 wrote to memory of 1112	2008	file.exe	29
PID 2008 wrote to memory of 1112	2008	file.exe	29
PID 2008 wrote to memory of 1112	2008	file.exe	29
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1068	1968	123.exe	31
PID 1968 wrote to memory of 1560	1968	123.exe	32
PID 1968 wrote to memory of 1560	1968	123.exe	32
PID 1968 wrote to memory of 1560	1968	123.exe	32
PID 1968 wrote to memory of 1560	1968	123.exe	32
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 1664	1112	321.exe	33
PID 1112 wrote to memory of 960	1112	321.exe	34
PID 1112 wrote to memory of 960	1112	321.exe	34
PID 1112 wrote to memory of 960	1112	321.exe	34
PID 1112 wrote to memory of 960	1112	321.exe	34
PID 1664 wrote to memory of 860	1664	vbc.exe	36
PID 1664 wrote to memory of 860	1664	vbc.exe	36
PID 1664 wrote to memory of 860	1664	vbc.exe	36
PID 1664 wrote to memory of 860	1664	vbc.exe	36

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 48
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1560
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
      4⤵
      PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 48
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path \Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path \Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-73-0x0000000000080000-0x00000000000B2000-memory.dmp

Download

memory/1068-75-0x0000000000080000-0x00000000000B2000-memory.dmp

Download

memory/1068-67-0x0000000000080000-0x00000000000B2000-memory.dmp

Download

memory/1068-65-0x0000000000080000-0x00000000000B2000-memory.dmp

Download

memory/1664-80-0x0000000000410000-0x00000000006A0000-memory.dmp

Download

memory/1664-87-0x0000000000410000-0x00000000006A0000-memory.dmp

Download

memory/1664-96-0x0000000000410000-0x00000000006A0000-memory.dmp

Download

memory/2008-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Download