redline | e7979de4e2337209f9c7b7159efef2a35bcbca92f79874a791fd7c8fc719f9ea

Analysis

max time kernel
87s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 1.2MB
Sample230419-bk4gjsfd53
SHA256 e7979de4e2337209f9c7b7159efef2a35bcbca92f79874a791fd7c8fc719f9ea
MD5 9f0b603a5f38cc1b0bd11dc2475cf5ec
SHA1 70ecd01fac8eb5659d53cf5bd1e92403aa4f99a5
SHA512 ec7bd918d84163160a6d696ac809a0eba8ecb22808f3149742ce4eca4b7dd1967136d66dacb866b1d341f85a16695d6f5b360e41e79828e65499bd15dea2609c
SSDEEP 6144:b81DzEX+SPwjmkAOqgkSLZSYiU6TpMIpewjelCRdm:o1DzEM0VSVXi/pewvjm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

135.181.241.192:4327

Attributes

auth_value
a909e2aaecf96137978fea4f86400b9b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 1040	5076	setup.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4732	5076	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	RegSvcs.exe
1040	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1040	5076	setup.exe	82
PID 5076 wrote to memory of 1040	5076	setup.exe	82
PID 5076 wrote to memory of 1040	5076	setup.exe	82
PID 5076 wrote to memory of 1040	5076	setup.exe	82
PID 5076 wrote to memory of 1040	5076	setup.exe	82

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 620
  2⤵
  - Program crash
  PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5076 -ip 5076
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-133-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1040-138-0x000000000B010000-0x000000000B628000-memory.dmp

Download

memory/1040-139-0x000000000AB00000-0x000000000AC0A000-memory.dmp

Download

memory/1040-140-0x000000000AA30000-0x000000000AA42000-memory.dmp

Download

memory/1040-141-0x000000000AA90000-0x000000000AACC000-memory.dmp

Download

memory/1040-142-0x0000000005660000-0x0000000005670000-memory.dmp

Download

memory/1040-143-0x000000000ADA0000-0x000000000AE16000-memory.dmp

Download

memory/1040-144-0x000000000AEC0000-0x000000000AF52000-memory.dmp

Download

memory/1040-145-0x000000000BBE0000-0x000000000C184000-memory.dmp

Download

memory/1040-146-0x000000000AF60000-0x000000000AFC6000-memory.dmp

Download

memory/1040-147-0x000000000C360000-0x000000000C522000-memory.dmp

Download

memory/1040-148-0x000000000CA60000-0x000000000CF8C000-memory.dmp

Download

memory/1040-149-0x0000000005660000-0x0000000005670000-memory.dmp

Download