redline | 2d48bc00f7f660d2c78d3a01559ca4a8e16761fc074d225ab6af4954b80282ec

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0671e541dd49a75a51d3190702aa9a61.exe
Size

294KB
MD5

0671e541dd49a75a51d3190702aa9a61
SHA1

4b259b247e91d05518f998c1d2e0f1456b5392b2
SHA256

2d48bc00f7f660d2c78d3a01559ca4a8e16761fc074d225ab6af4954b80282ec
SHA512

af59e97b416b5e035f4b676b28fd4d81d103299f5e934b3a8b3cf01a393931dfd0a4a0878ee79157e5df6aadacd5436e07e352e16d9fc3d747ab514cf320cb7d
SSDEEP

3072:XhVbaRGSFaMmFWFu8RYN2yDc4TqkuqCMisloA4dKfslVBVNovhSxov3xB4XhfxV:y3mFW8bc5jMrloA40fsVVESyvn4l

Score

10^/10

redline 10 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

89.22.237.107:24535

Attributes

auth_value
6b5e517291c4d46e2fb551701ebd3f2f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

0671e541dd49a75a51d3190702aa9a61.exe

description pid process target process

PID 2092 set thread context of 1652 2092 0671e541dd49a75a51d3190702aa9a61.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1584 2092 WerFault.exe 0671e541dd49a75a51d3190702aa9a61.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

1652 AppLaunch.exe
1652 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1652 AppLaunch.exe

description	pid	process	target process
PID 2092 set thread context of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe

pid	pid_target	process	target process
1584	2092	WerFault.exe	0671e541dd49a75a51d3190702aa9a61.exe

pid	process
1652	AppLaunch.exe
1652	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1652	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

0671e541dd49a75a51d3190702aa9a61.exe

description	pid	process	target process
PID 2092 wrote to memory of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2092 wrote to memory of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2092 wrote to memory of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2092 wrote to memory of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe
PID 2092 wrote to memory of 1652	2092	0671e541dd49a75a51d3190702aa9a61.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\0671e541dd49a75a51d3190702aa9a61.exe
"C:\Users\Admin\AppData\Local\Temp\0671e541dd49a75a51d3190702aa9a61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 512
2⤵
- Program crash
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2092 -ip 2092
1⤵
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-133-0x0000000000410000-0x0000000000442000-memory.dmp

Filesize
200KB

Download
memory/1652-138-0x0000000005120000-0x0000000005738000-memory.dmp

Filesize
6.1MB

Download
memory/1652-139-0x0000000004C10000-0x0000000004D1A000-memory.dmp

Filesize
1.0MB

Download
memory/1652-140-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/1652-141-0x0000000002750000-0x000000000278C000-memory.dmp

Filesize
240KB

Download
memory/1652-142-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1652-143-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Filesize
584KB

Download
memory/1652-144-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/1652-145-0x0000000005030000-0x0000000005096000-memory.dmp

Filesize
408KB

Download
memory/1652-146-0x00000000065B0000-0x0000000006772000-memory.dmp

Filesize
1.8MB

Download
memory/1652-147-0x0000000006CB0000-0x00000000071DC000-memory.dmp

Filesize
5.2MB

Download
memory/1652-148-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download