redline | 74fed27c33b9d80c0c18081bacf6778fe2a892c58643ad2b9811380181197e9b

General

Target

file.exe
Size

431KB
MD5

b8c62b2027dce8cc981a2f1093595f57
SHA1

d97f8c7e6476777d1cb8f6ff2f9885b02cdf2188
SHA256

74fed27c33b9d80c0c18081bacf6778fe2a892c58643ad2b9811380181197e9b
SHA512

4280154fe87b67b4c731e3287f7439755d6986ad08c08086cf84205433464888f3a175b80c26bb2a8258a18922d8fd13eb3a98f2bf0a9673e23ca0a1789be695
SSDEEP

12288:yYFDa27qhRYzrpNoUEocLsOV2Rsvs+kvQR4lO:lYuqXccHJLJARQsLlO

Score

10^/10

redline instals evasion infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

Instals

C2

89.23.97.107:8086

Attributes

auth_value
8a82a3c9eb67dfb581f57e3f2c7aefe6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	file.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	file.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1852	1732	file.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
520	1852	WerFault.exe	31

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1732	file.exe
1732	file.exe
1732	file.exe
1732	file.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1732	file.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	file.exe
Token: SeLoadDriverPrivilege	1732	file.exe
Token: SeDebugPrivilege	1732	file.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1472	1732	file.exe	29
PID 1732 wrote to memory of 1472	1732	file.exe	29
PID 1732 wrote to memory of 1472	1732	file.exe	29
PID 1732 wrote to memory of 580	1732	file.exe	30
PID 1732 wrote to memory of 580	1732	file.exe	30
PID 1732 wrote to memory of 580	1732	file.exe	30
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1732 wrote to memory of 1852	1732	file.exe	31
PID 1852 wrote to memory of 520	1852	SetupUtility.exe	32
PID 1852 wrote to memory of 520	1852	SetupUtility.exe	32
PID 1852 wrote to memory of 520	1852	SetupUtility.exe	32
PID 1852 wrote to memory of 520	1852	SetupUtility.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Sets service image path in registry
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 168
    3⤵
    - Program crash
    PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000000F30000-0x0000000000FA0000-memory.dmp

Filesize
448KB

Download
memory/1732-55-0x000000001BCD0000-0x000000001BD50000-memory.dmp

Filesize
512KB

Download
memory/1852-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads