redline | bc3e7a7322cfbb7fcfcc076a56d042e7c4f91d1b7284167773a53681fed06e38

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-01-2023 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a726416e69318522b27e7eb0595bdb6a.exe
Size

385KB
MD5

a726416e69318522b27e7eb0595bdb6a
SHA1

402077e6be869e60d75477cf8a3d4bc880e56b5b
SHA256

bc3e7a7322cfbb7fcfcc076a56d042e7c4f91d1b7284167773a53681fed06e38
SHA512

3f5a5891d4669464931db159fd29fc02ee29b8e1ee86a493b43efc75a8876d0ef89f88c18586c3b916be2e9b440c5ffba9e8b66e4cdb2458e69e884838f87ae9
SSDEEP

6144:XN45ZtXLHb68+KEcwjczdUR4N5pwY96S132S2pxBHkbbvi5t+ef23x/LPII+:K5TP68+NczaW2w6S1GS9bb8Hf23xTQ1

Score

10^/10

redline love infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

love

45.15.157.0:22598

Attributes

auth_value
f2b8ce19d1b1584a3972de28dfe5bf40

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

a726416e69318522b27e7eb0595bdb6a.exe

description pid process target process

PID 1108 set thread context of 916 1108 a726416e69318522b27e7eb0595bdb6a.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

916 AppLaunch.exe
916 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 916 AppLaunch.exe

description	pid	process	target process
PID 1108 set thread context of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe

pid	process
916	AppLaunch.exe
916	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	916	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a726416e69318522b27e7eb0595bdb6a.exe

description	pid	process	target process
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe
PID 1108 wrote to memory of 916	1108	a726416e69318522b27e7eb0595bdb6a.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\a726416e69318522b27e7eb0595bdb6a.exe
"C:\Users\Admin\AppData\Local\Temp\a726416e69318522b27e7eb0595bdb6a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/916-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/916-61-0x000000000041B586-mapping.dmp

Download
memory/916-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/916-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/916-64-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download