redline | bc0c6f3edcce5f2b15ce4c6f1dbb391c8379693ddf7532462f33857eb6f0ffbd

General

Target

Camtasia.exe
Size

701.0MB
MD5

3edabce0833a1fe15dcf374c29ad293e
SHA1

68aec7add651fcb8597a0b5e5943b9bc460e4875
SHA256

bc0c6f3edcce5f2b15ce4c6f1dbb391c8379693ddf7532462f33857eb6f0ffbd
SHA512

1f34ff99afd072fea608cc52887f1d11726bf02c043d76cee24403a6f4bfa18e9ef7bbe916a31dae5600a5e9fa0785bd48836788306f4211dd24096b9e2a58db
SSDEEP

3072:q1/3moQkgU0CwlvwReBFpkVLSYrVEWYw+QeTOUD69qjiwcI/s2o7Pn9SgOStEWLU:yWxNv+eyOq+JTDaq2Jf2mnAgNfSVLD

Score

10^/10

redline yt infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

yt

C2

65.109.139.121:28859

Attributes

auth_value
c85b149d6d3359b3fe4dd1dfcc5864e8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 1 IoCs

Processes:

TrashExe (1).exe

pid process

2044 TrashExe (1).exe
Loads dropped DLL 2 IoCs

Processes:

Camtasia.exe

pid process

1496 Camtasia.exe
1496 Camtasia.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Camtasia.exe

description pid process target process

PID 1496 set thread context of 1996 1496 Camtasia.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

1996 vbc.exe
1996 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 1996 vbc.exe

pid	process
2044	TrashExe (1).exe

pid	process
1496	Camtasia.exe
1496	Camtasia.exe

description	pid	process	target process
PID 1496 set thread context of 1996	1496	Camtasia.exe	vbc.exe

pid	process
1996	vbc.exe
1996	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1996	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Camtasia.exe

description	pid	process	target process
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 1996	1496	Camtasia.exe	vbc.exe
PID 1496 wrote to memory of 2044	1496	Camtasia.exe	TrashExe (1).exe
PID 1496 wrote to memory of 2044	1496	Camtasia.exe	TrashExe (1).exe
PID 1496 wrote to memory of 2044	1496	Camtasia.exe	TrashExe (1).exe
PID 1496 wrote to memory of 2044	1496	Camtasia.exe	TrashExe (1).exe

C:\Users\Admin\AppData\Local\Temp\Camtasia.exe
"C:\Users\Admin\AppData\Local\Temp\Camtasia.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
"C:\Users\Admin\AppData\Local\Temp\TrashExe (1).exe"
2⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
\Users\Admin\AppData\Local\Temp\TrashExe (1).exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
memory/1496-67-0x0000000004490000-0x00000000044D0000-memory.dmp

Filesize
256KB

Download
memory/1496-55-0x0000000000800000-0x0000000000832000-memory.dmp

Filesize
200KB

Download
memory/1496-79-0x0000000004490000-0x00000000044D0000-memory.dmp

Filesize
256KB

Download
memory/1496-54-0x0000000000D20000-0x0000000000D62000-memory.dmp

Filesize
264KB

Download
memory/1996-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-66-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-64-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-61-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1996-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-57-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1996-78-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/1996-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-77-0x00000000000A0000-0x00000000000A8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing