redline | a88de17a29eaaaab996f32b4ddb579d5930b7d1f152bfb10018481e2b5612d70

Analysis

max time kernel
94s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.1MB
Sample230113-q6d64shd23
SHA256 a88de17a29eaaaab996f32b4ddb579d5930b7d1f152bfb10018481e2b5612d70
MD5 31989a60648d81e2b1692bf5ee6807b7
SHA1 3bccd5583b0bb864b1473f43940ca1cdf87142c4
SHA512 99b2d0cde5f9f2124842a45851b4273ffb230616568376e3aeebd98dbabf20170e31a622233a23ee0e7de6d1fa0aae70f35a2e790ee89197ba17bbdfdb62ddd6
SSDEEP 49152:V5OMhQHLK7nxP07X/cR9iTTt2NEsSB9IVh+0Y:V5wsP0j/cRUvtsEZB9IjY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1800	123.exe
3292	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 4628	1800	123.exe	86
PID 3292 set thread context of 4772	3292	321.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2224	1800	WerFault.exe	81
2688	3292	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	vbc.exe
4628	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1800	4640	file.exe	81
PID 4640 wrote to memory of 1800	4640	file.exe	81
PID 4640 wrote to memory of 1800	4640	file.exe	81
PID 4640 wrote to memory of 3292	4640	file.exe	84
PID 4640 wrote to memory of 3292	4640	file.exe	84
PID 4640 wrote to memory of 3292	4640	file.exe	84
PID 1800 wrote to memory of 4628	1800	123.exe	86
PID 1800 wrote to memory of 4628	1800	123.exe	86
PID 1800 wrote to memory of 4628	1800	123.exe	86
PID 1800 wrote to memory of 4628	1800	123.exe	86
PID 1800 wrote to memory of 4628	1800	123.exe	86
PID 3292 wrote to memory of 4772	3292	321.exe	93
PID 3292 wrote to memory of 4772	3292	321.exe	93
PID 3292 wrote to memory of 4772	3292	321.exe	93
PID 3292 wrote to memory of 4772	3292	321.exe	93
PID 3292 wrote to memory of 4772	3292	321.exe	93
PID 4772 wrote to memory of 1988	4772	vbc.exe	96
PID 4772 wrote to memory of 1988	4772	vbc.exe	96
PID 4772 wrote to memory of 1988	4772	vbc.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 256
    3⤵
    - Program crash
    PID:2224
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
      4⤵
      PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 156
    3⤵
    - Program crash
    PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1800 -ip 1800
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3292 -ip 3292
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bebra.exe

Path C:\Users\Admin\AppData\Roaming\bebra.exe
Size 5B
SHA256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
MD5 8b1a9953c4611296a827abf8c47804d7
SHA1 f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA512 3615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
MD5 SHA1 SHA512

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 375KB
SHA256 44f0d8416c0bda629160ea3a124b979f689516459c896cca92336b831f0f70bc
MD5 8e923113d96402e691624621f75c9329
SHA1 8d7aa688c42b4087056d38b27ab2ec3265fd6fe4
SHA512 ecab95b6c984c781729a8fca404198de1a8afc59ac37acafb22f8d522e699d1a456edcbc28db7f95e33b22871ff14fdfacd62a07cff2624ec2c728cfa2c57fad
SSDEEP 6144:b138PLuqxYKBu037OQ83oIPTAO/FK6wpS2MGr0sBEgONHwJ0:b58PLuqxYKBudTD1VC0sagONHK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.7MB
SHA256 eb8217ae1609374fede185df73f3f31125ebe831b85e86d02b8eaa1af7155b1a
MD5 fc3d60607f11ff6b339099510784e6b8
SHA1 a431e476de40e34bb65e1330345b5904e78faeb7
SHA512 451b30eae300492555204171e265105fd7ffa2eef3eaa35dd16ad724a9f7ce39411775b3299898ceb1e9e44a41b395125d3278b26d80eb5f3dfda1a39f636366
SSDEEP 49152:S4bnduTcfqdaBz31rQ6B2yKw2UAizCTVOWzWvP/b/Y5jtAVzLuRJYNMJNdt4mJTa:S4bduAqda3xZREVOWzaMjtiHu30X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4628-165-0x00000000067F0000-0x0000000006D94000-memory.dmp

Download

memory/4628-139-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4628-146-0x0000000005680000-0x0000000005692000-memory.dmp

Download

memory/4628-147-0x00000000056E0000-0x000000000571C000-memory.dmp

Download

memory/4628-170-0x0000000007FA0000-0x00000000084CC000-memory.dmp

Download

memory/4628-169-0x0000000007190000-0x0000000007352000-memory.dmp

Download

memory/4628-168-0x0000000006750000-0x00000000067A0000-memory.dmp

Download

memory/4628-144-0x0000000005C20000-0x0000000006238000-memory.dmp

Download

memory/4628-164-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Download

memory/4628-145-0x0000000005750000-0x000000000585A000-memory.dmp

Download

memory/4628-166-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/4628-167-0x00000000076E0000-0x0000000007756000-memory.dmp

Download

memory/4772-161-0x0000000000400000-0x0000000000690000-memory.dmp

Download

memory/4772-149-0x0000000000400000-0x0000000000690000-memory.dmp

Download