redline | 8eb56a2f631dd8b6e3cf827e2022dd3714b805eb377d4e186a41384ec624376c

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-06-2023 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01366899.exe
Size

1.7MB
MD5

a4aab901f5f4662d75a66bdb08971148
SHA1

9835bae8776e280b5a6bcf8e204d1bca5e05b0f6
SHA256

8eb56a2f631dd8b6e3cf827e2022dd3714b805eb377d4e186a41384ec624376c
SHA512

a4a86338d24118d20242714da4ac9df72a0954c7c7cfa4be80cb2495b2ced651e328b4fbf1e66ac844f76f838efd591baade7b2dca019917964ac0b7a73c479f
SSDEEP

24576:YwJAcH22+6MA333QaUozWal46B7Owg/63wXByw/OK:bJAcH22KA3339UPaewgrByq

Score

10^/10

redline 090623_11_red infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

090623_11_red

goodlogs.neverever.ug:11615

Attributes

auth_value
ca62706abf6895102883ab0c8a86ddff

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

01366899.exe

description pid process target process

PID 1720 set thread context of 564 1720 01366899.exe jsc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jsc.exe

pid process

564 jsc.exe
564 jsc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

01366899.exejsc.exe

description pid process

Token: SeDebugPrivilege 1720 01366899.exe
Token: SeDebugPrivilege 564 jsc.exe

description	pid	process	target process
PID 1720 set thread context of 564	1720	01366899.exe	jsc.exe

pid	process
564	jsc.exe
564	jsc.exe

description	pid	process
Token: SeDebugPrivilege	1720	01366899.exe
Token: SeDebugPrivilege	564	jsc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

01366899.exe

description	pid	process	target process
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe
PID 1720 wrote to memory of 564	1720	01366899.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\01366899.exe
"C:\Users\Admin\AppData\Local\Temp\01366899.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/564-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/564-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/564-62-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/564-63-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/1720-54-0x0000000000A30000-0x0000000000BE6000-memory.dmp

Filesize
1.7MB

Download
memory/1720-55-0x000000001A930000-0x000000001A9B0000-memory.dmp

Filesize
512KB

Download
memory/1720-56-0x0000000002360000-0x00000000023D2000-memory.dmp

Filesize
456KB

Download