Malware Analysis Report

2025-04-13 11:13

Sample ID 230129-y6gw1aca56
Target fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade
SHA256 fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade
Tags
redline 1 infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade

Threat Level: Known bad

The file fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade was found to be: Known bad.

Malicious Activity Summary

redline 1 infostealer

RedLine

RedLine payload

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-01-29 20:23

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-29 20:23

Reported

2023-01-29 20:26

Platform

win10v2004-20220812-en

Max time kernel

163s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2588 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe

"C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Network

Country Destination Domain Proto
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 95.101.78.106:80 tcp
N/A 95.101.78.106:80 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 51.116.253.168:443 tcp
N/A 87.251.71.13:80 tcp
N/A 93.184.220.29:80 tcp
N/A 87.251.71.13:80 tcp
N/A 93.184.221.240:80 tcp
N/A 87.251.71.13:80 tcp
N/A 93.184.221.240:80 tcp
N/A 87.251.71.13:80 tcp
N/A 93.184.221.240:80 tcp
N/A 87.251.71.13:80 tcp
N/A 93.184.221.240:80 tcp
N/A 87.251.71.13:80 tcp

Files

memory/2588-132-0x0000000000B70000-0x0000000000C72000-memory.dmp

memory/1240-133-0x0000000000000000-mapping.dmp

memory/1240-134-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1240-135-0x0000000005030000-0x00000000050A6000-memory.dmp

memory/1240-136-0x0000000002B40000-0x0000000002B5E000-memory.dmp

memory/1240-137-0x0000000005750000-0x0000000005D68000-memory.dmp

memory/1240-138-0x0000000005130000-0x0000000005142000-memory.dmp

memory/1240-139-0x0000000005190000-0x00000000051CC000-memory.dmp

memory/1240-140-0x0000000005430000-0x000000000553A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-29 20:23

Reported

2023-01-29 20:26

Platform

win7-20220812-en

Max time kernel

131s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 884 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe

"C:\Users\Admin\AppData\Local\Temp\fa8ffff06b2e303a2f2c6a492f223605ff84d8bf31eaed7b12dfe503dc1c6ade.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Network

Country Destination Domain Proto
N/A 87.251.71.13:80 tcp
N/A 87.251.71.13:80 tcp
N/A 87.251.71.13:80 tcp
N/A 87.251.71.13:80 tcp
N/A 87.251.71.13:80 tcp

Files

memory/884-54-0x0000000000EC0000-0x0000000000FC2000-memory.dmp

memory/884-55-0x00000000005C0000-0x00000000005DA000-memory.dmp

memory/1736-56-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1736-57-0x0000000000423F7E-mapping.dmp

memory/1736-59-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1736-61-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1736-62-0x0000000075DF1000-0x0000000075DF3000-memory.dmp