redline | e34d698b7f65d8352dbe30c9ce05f9ecd9003a30b3a6a454b83ad70260c0926f

Analysis

max time kernel
53s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.2MB
Sample230129-mtdg9sbf88
SHA256 e34d698b7f65d8352dbe30c9ce05f9ecd9003a30b3a6a454b83ad70260c0926f
MD5 07e049ff169334544a193efac5ea0fd3
SHA1 9df8b9b5dfee62e0a46f3105b27407af12b27399
SHA512 701c255455a473269138fac3f4dbc853ba8af62656ee37a2a3dfbd391da35a5267ea682b07b48795aa654bf31875a64e9db806932e5469cc797c60f81566cb36
SSDEEP 24576:0NA3R5drX/WaTjoGakMLQODrU/PAH7bS/34UqgCnKwOFbPfy1nHojjkTxP10WB4Q:V5OJGsQakAH7hUqOwY6nHojjkF17ih+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
3936	123.exe
3140	321.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	file.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 4800	3936	123.exe	83
PID 3140 set thread context of 4696	3140	321.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4684	3936	WerFault.exe	77
4628	3140	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	vbc.exe
4800	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3936	2604	file.exe	77
PID 2604 wrote to memory of 3936	2604	file.exe	77
PID 2604 wrote to memory of 3936	2604	file.exe	77
PID 2604 wrote to memory of 3140	2604	file.exe	80
PID 2604 wrote to memory of 3140	2604	file.exe	80
PID 2604 wrote to memory of 3140	2604	file.exe	80
PID 3936 wrote to memory of 4800	3936	123.exe	83
PID 3936 wrote to memory of 4800	3936	123.exe	83
PID 3936 wrote to memory of 4800	3936	123.exe	83
PID 3936 wrote to memory of 4800	3936	123.exe	83
PID 3936 wrote to memory of 4800	3936	123.exe	83
PID 3140 wrote to memory of 4696	3140	321.exe	87
PID 3140 wrote to memory of 4696	3140	321.exe	87
PID 3140 wrote to memory of 4696	3140	321.exe	87
PID 3140 wrote to memory of 4696	3140	321.exe	87
PID 3140 wrote to memory of 4696	3140	321.exe	87
PID 4696 wrote to memory of 396	4696	vbc.exe	90
PID 4696 wrote to memory of 396	4696	vbc.exe	90
PID 4696 wrote to memory of 396	4696	vbc.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 160
    3⤵
    - Program crash
    PID:4684
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
      4⤵
      PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 240
    3⤵
    - Program crash
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3936 -ip 3936
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3140 -ip 3140
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bebra.exe

Path C:\Users\Admin\AppData\Roaming\bebra.exe
Size 5B
SHA256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
MD5 8b1a9953c4611296a827abf8c47804d7
SHA1 f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA512 3615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
MD5 SHA1 SHA512

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 515KB
SHA256 7f321fe2508898878bd678db6c966fdfa4fdf8131292a84a5587a48494dd5367
MD5 106e095e9d3626bf34e32ab2d6d59a6b
SHA1 95aa15cc77501101c07e4a25f27cd143d9ffd55a
SHA512 82cd23f681e78fe74c6a1b0e0ecc76220e48fc1284bb03267b512190d9b8df7e667b13a5b94de245f8535347b2b4d57af9373ee06d17f0e1b775d3d0979581f0
SSDEEP 12288:qMUt/qA5Z3ucHBDQqFaSwpJLTMwOHAOtgaT0u:qMUt/qAH3ucHBDQ3pJcvFtgYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 515KB
SHA256 7f321fe2508898878bd678db6c966fdfa4fdf8131292a84a5587a48494dd5367
MD5 106e095e9d3626bf34e32ab2d6d59a6b
SHA1 95aa15cc77501101c07e4a25f27cd143d9ffd55a
SHA512 82cd23f681e78fe74c6a1b0e0ecc76220e48fc1284bb03267b512190d9b8df7e667b13a5b94de245f8535347b2b4d57af9373ee06d17f0e1b775d3d0979581f0
SSDEEP 12288:qMUt/qA5Z3ucHBDQqFaSwpJLTMwOHAOtgaT0u:qMUt/qAH3ucHBDQ3pJcvFtgYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.9MB
SHA256 b3f23bac3aa19773d4c0947778405d537610afe4aa96cd1b1ed5947a13fbc947
MD5 e4f045fb47ac147bba4c73bc5cb5ce73
SHA1 b995d01cbceb7c16e7ca2762933264d065edd059
SHA512 9e791a18d970d1bcde96234515d49ae6eb14be6388e6d0453302f075b20c83f315d9bf4ff62f2289a8d1eb0d8c5910ef9fc907d8115b175c4f2976920dfa6023
SSDEEP 49152:AzE3wY5nfTAjkGSTm3i0kZwHlVa22lNvBgAoEKZOagdu1F48/kpNNoJuBK39N3eg:lgjzyMlArG22hA
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 2.9MB
SHA256 b3f23bac3aa19773d4c0947778405d537610afe4aa96cd1b1ed5947a13fbc947
MD5 e4f045fb47ac147bba4c73bc5cb5ce73
SHA1 b995d01cbceb7c16e7ca2762933264d065edd059
SHA512 9e791a18d970d1bcde96234515d49ae6eb14be6388e6d0453302f075b20c83f315d9bf4ff62f2289a8d1eb0d8c5910ef9fc907d8115b175c4f2976920dfa6023
SSDEEP 49152:AzE3wY5nfTAjkGSTm3i0kZwHlVa22lNvBgAoEKZOagdu1F48/kpNNoJuBK39N3eg:lgjzyMlArG22hA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4696-145-0x0000000000A10000-0x0000000000CA0000-memory.dmp

Download

memory/4696-159-0x0000000000A10000-0x0000000000CA0000-memory.dmp

Download

memory/4800-160-0x0000000005280000-0x0000000005292000-memory.dmp

Download

memory/4800-157-0x0000000005350000-0x000000000545A000-memory.dmp

Download

memory/4800-153-0x00000000057E0000-0x0000000005DF8000-memory.dmp

Download

memory/4800-161-0x00000000052E0000-0x000000000531C000-memory.dmp

Download

memory/4800-139-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4800-164-0x00000000063B0000-0x0000000006954000-memory.dmp

Download

memory/4800-165-0x0000000005E00000-0x0000000005E92000-memory.dmp

Download

memory/4800-166-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/4800-167-0x0000000006B30000-0x0000000006CF2000-memory.dmp

Download

memory/4800-168-0x0000000007230000-0x000000000775C000-memory.dmp

Download

memory/4800-169-0x0000000006D00000-0x0000000006D76000-memory.dmp

Download

memory/4800-170-0x0000000006AB0000-0x0000000006B00000-memory.dmp

Download