redline | 2d48bc00f7f660d2c78d3a01559ca4a8e16761fc074d225ab6af4954b80282ec

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0671e541dd49a75a51d3190702aa9a61.exe
Size

294KB
MD5

0671e541dd49a75a51d3190702aa9a61
SHA1

4b259b247e91d05518f998c1d2e0f1456b5392b2
SHA256

2d48bc00f7f660d2c78d3a01559ca4a8e16761fc074d225ab6af4954b80282ec
SHA512

af59e97b416b5e035f4b676b28fd4d81d103299f5e934b3a8b3cf01a393931dfd0a4a0878ee79157e5df6aadacd5436e07e352e16d9fc3d747ab514cf320cb7d
SSDEEP

3072:XhVbaRGSFaMmFWFu8RYN2yDc4TqkuqCMisloA4dKfslVBVNovhSxov3xB4XhfxV:y3mFW8bc5jMrloA40fsVVESyvn4l

Score

10^/10

redline 10 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

89.22.237.107:24535

Attributes

auth_value
6b5e517291c4d46e2fb551701ebd3f2f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

0671e541dd49a75a51d3190702aa9a61.exe

description pid process target process

PID 2040 set thread context of 2036 2040 0671e541dd49a75a51d3190702aa9a61.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1836 2040 WerFault.exe 0671e541dd49a75a51d3190702aa9a61.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2036 AppLaunch.exe
2036 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2036 AppLaunch.exe

description	pid	process	target process
PID 2040 set thread context of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe

pid	pid_target	process	target process
1836	2040	WerFault.exe	0671e541dd49a75a51d3190702aa9a61.exe

pid	process
2036	AppLaunch.exe
2036	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2036	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

0671e541dd49a75a51d3190702aa9a61.exe

description	pid	process	target process
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 2036	2040	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2040 wrote to memory of 1836	2040	0671e541dd49a75a51d3190702aa9a61.exe	WerFault.exe
PID 2040 wrote to memory of 1836	2040	0671e541dd49a75a51d3190702aa9a61.exe	WerFault.exe
PID 2040 wrote to memory of 1836	2040	0671e541dd49a75a51d3190702aa9a61.exe	WerFault.exe
PID 2040 wrote to memory of 1836	2040	0671e541dd49a75a51d3190702aa9a61.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0671e541dd49a75a51d3190702aa9a61.exe
"C:\Users\Admin\AppData\Local\Temp\0671e541dd49a75a51d3190702aa9a61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 36
2⤵
- Program crash
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x00000000000D0000-0x0000000000102000-memory.dmp

Filesize
200KB

Download
memory/2036-55-0x00000000000D0000-0x0000000000102000-memory.dmp

Filesize
200KB

Download
memory/2036-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2036-61-0x00000000000D0000-0x0000000000102000-memory.dmp

Filesize
200KB

Download
memory/2036-62-0x00000000000D0000-0x0000000000102000-memory.dmp

Filesize
200KB

Download
memory/2036-63-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download