redline | 8f136c424f604be973a76795d1de0dca7281ca25e543e264565d753e2dea404c

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/01/2023, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 2.2MB
Sample230125-khk2vsfe23
SHA256 8f136c424f604be973a76795d1de0dca7281ca25e543e264565d753e2dea404c
MD5 f62872fe4592273abda6f704fb27b3ec
SHA1 c9f193458f5b59a81b3fcb6fed90112d6d0dd48f
SHA512 c0d974bd1605ddff4fc06251689c49bce541a5ea9b0d1137c3d250d164ea347fe44823bf4140950c5d58e3dbd5822aadca85afd0dd8ce15224d679f2c40a11b8
SSDEEP 24576:SbS0tTtCM79UnERXLb9HOlSEE2Rly1luF/6yQhA68NNMOJMD+WDeQGl4Z1cb8zQi:y7TLhwSEeJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline evasion infostealer spyware trojan

Malware Config

Extracted

Family

redline

82.115.223.46:57672

Attributes

auth_value
7352deef2adb5a71ae170f48b8b9de21

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 952	1784	Installer.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	AppLaunch.exe
952	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29
PID 1784 wrote to memory of 952	1784	Installer.exe	29

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-56-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/952-58-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/952-64-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/952-65-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1784-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Download

memory/1784-55-0x0000000000BD1000-0x0000000000BD3000-memory.dmp

Download