redline | 4705cd053d069d919229c4bae91b6b527e217230030611def357f89dc19e7c1d

Analysis

max time kernel
91s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2023, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.1MB
Sample230217-m2s8paef2s
SHA256 4705cd053d069d919229c4bae91b6b527e217230030611def357f89dc19e7c1d
MD5 cb0bf243fa23ddaba0aa5c2434bc03f8
SHA1 5da36574df75629dc4ff9af07b9ec9585645f007
SHA512 f5965169cd67883e33193bcd04a0e8ad78588fb3cde14e711e6a1b006510530e6a767383824f4b71af4170eda30398d9b6a752e1ae8b2bdf24b2fd6768401e50
SSDEEP 49152:V5O6TlFQPz6xoic4DXXdA9QcceklxDEhR:V5TTlF8zzCXMQxemDi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.161.104.92:47909

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 2 IoCs

pid	Process
1080	123.exe
2400	321.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 3864	1080	123.exe	86
PID 2400 set thread context of 2952	2400	321.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2364	1080	WerFault.exe	81
4592	2400	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3864	vbc.exe
3864	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1080	4732	file.exe	81
PID 4732 wrote to memory of 1080	4732	file.exe	81
PID 4732 wrote to memory of 1080	4732	file.exe	81
PID 4732 wrote to memory of 2400	4732	file.exe	84
PID 4732 wrote to memory of 2400	4732	file.exe	84
PID 4732 wrote to memory of 2400	4732	file.exe	84
PID 1080 wrote to memory of 3864	1080	123.exe	86
PID 1080 wrote to memory of 3864	1080	123.exe	86
PID 1080 wrote to memory of 3864	1080	123.exe	86
PID 1080 wrote to memory of 3864	1080	123.exe	86
PID 1080 wrote to memory of 3864	1080	123.exe	86
PID 2400 wrote to memory of 2952	2400	321.exe	88
PID 2400 wrote to memory of 2952	2400	321.exe	88
PID 2400 wrote to memory of 2952	2400	321.exe	88
PID 2400 wrote to memory of 2952	2400	321.exe	88
PID 2400 wrote to memory of 2952	2400	321.exe	88
PID 2952 wrote to memory of 3420	2952	vbc.exe	92
PID 2952 wrote to memory of 3420	2952	vbc.exe	92
PID 2952 wrote to memory of 3420	2952	vbc.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 240
    3⤵
    - Program crash
    PID:2364
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
      4⤵
      PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 240
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1080 -ip 1080
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2400 -ip 2400
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bebra.exe

Path C:\Users\Admin\AppData\Roaming\bebra.exe
Size 5B
SHA256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
MD5 8b1a9953c4611296a827abf8c47804d7
SHA1 f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA512 3615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
MD5 SHA1 SHA512

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 1.1MB
SHA256 b45860efae9835e8d0c59818cb9dda3cdebc230190f0fa06b1852b1a81ac5a4d
MD5 88a6af1592a7722d25521024bfb839d7
SHA1 9eac4952a330f6ba0f3d1229975e77344c70ab7b
SHA512 c6947c079964f931ca298041c0c6b6e673d4d709a68fa9c287b5326739fdd9660090b83cad7e40aa82d178bcdf2e7f7c9f7a2b5523b1e2028d6d1b515c4c623c
SSDEEP 6144:sz0qWYounlGNBQAOFWDc+3LZrc1aX0/n2O1R/gFX7SkvyPj:sz0qWY4EYg1XSskej
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Windows\Temp\123.exe
Size 1.1MB
SHA256 b45860efae9835e8d0c59818cb9dda3cdebc230190f0fa06b1852b1a81ac5a4d
MD5 88a6af1592a7722d25521024bfb839d7
SHA1 9eac4952a330f6ba0f3d1229975e77344c70ab7b
SHA512 c6947c079964f931ca298041c0c6b6e673d4d709a68fa9c287b5326739fdd9660090b83cad7e40aa82d178bcdf2e7f7c9f7a2b5523b1e2028d6d1b515c4c623c
SSDEEP 6144:sz0qWYounlGNBQAOFWDc+3LZrc1aX0/n2O1R/gFX7SkvyPj:sz0qWY4EYg1XSskej
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 3.5MB
SHA256 77c6080168d845aa2450b81aa6690158e8a623685683e149fba1bc829fefb7e3
MD5 447cf3423c0c0fa272a1aa4dd50ad5f5
SHA1 fdeb5228a2e89e15d85a7602f7bd8ecfeae3a249
SHA512 17f8a9734ad3bb920d38fa62cc546906b8b59da52f99a1d931077329dfd2711617a07789cc7da6118664ee1311538bcdff807d5ca79ffc135137e4cc4646cd86
SSDEEP 98304:SdCK/0NXpuPrftgpXxJY48MaRMIH8/ZxOA:aCK4OrlgsHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

321.exe

Path C:\Windows\Temp\321.exe
Size 3.5MB
SHA256 77c6080168d845aa2450b81aa6690158e8a623685683e149fba1bc829fefb7e3
MD5 447cf3423c0c0fa272a1aa4dd50ad5f5
SHA1 fdeb5228a2e89e15d85a7602f7bd8ecfeae3a249
SHA512 17f8a9734ad3bb920d38fa62cc546906b8b59da52f99a1d931077329dfd2711617a07789cc7da6118664ee1311538bcdff807d5ca79ffc135137e4cc4646cd86
SSDEEP 98304:SdCK/0NXpuPrftgpXxJY48MaRMIH8/ZxOA:aCK4OrlgsHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2952-146-0x0000000000501000-0x0000000000760000-memory.dmp

Download

memory/2952-147-0x0000000000500000-0x0000000000790000-memory.dmp

Download

memory/2952-157-0x0000000000500000-0x0000000000790000-memory.dmp

Download

memory/3864-158-0x0000000005950000-0x0000000005F68000-memory.dmp

Download

memory/3864-159-0x0000000005440000-0x000000000554A000-memory.dmp

Download

memory/3864-161-0x0000000002CF0000-0x0000000002D02000-memory.dmp

Download

memory/3864-162-0x0000000005370000-0x00000000053AC000-memory.dmp

Download

memory/3864-139-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3864-164-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/3864-165-0x0000000006210000-0x00000000062A2000-memory.dmp

Download

memory/3864-166-0x0000000006860000-0x0000000006E04000-memory.dmp

Download

memory/3864-167-0x0000000008630000-0x00000000087F2000-memory.dmp

Download

memory/3864-168-0x0000000008D30000-0x000000000925C000-memory.dmp

Download

memory/3864-169-0x0000000006E10000-0x0000000006E86000-memory.dmp

Download

memory/3864-170-0x0000000006800000-0x0000000006850000-memory.dmp

Download