General

  • Target

    2636-63-0x0000000004180000-0x00000000041B4000-memory.dmp

  • Size

    208KB

  • Sample

    230810-w4c4xsab5v

  • MD5

    d72ea50d9b3dcf42dbcca424303b0e9d

  • SHA1

    8969f569642e1670af00d4d339d915a7a95ccb37

  • SHA256

    64ae95f87a315b58eed9b81f334ec34d7683d59e62dbf71269858206bfa45a5c

  • SHA512

    be87282ce45c0dac7c55cc0ba12a28aacb6bf5ad61ce36c32bbe5eb05f883b210ab327608e8a93aecd520b992f6279cfa420cabed5d84f0f66c8736566d645aa

  • SSDEEP

    3072:c2d6mtyOf3YItpGVH1/W92Ve/eV+9wdLxwafS8e8hq:x6mtyOgItpGgD/eUmZS

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

136.244.98.226:33587

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Targets

    • Target

      2636-63-0x0000000004180000-0x00000000041B4000-memory.dmp

    • Size

      208KB

    • MD5

      d72ea50d9b3dcf42dbcca424303b0e9d

    • SHA1

      8969f569642e1670af00d4d339d915a7a95ccb37

    • SHA256

      64ae95f87a315b58eed9b81f334ec34d7683d59e62dbf71269858206bfa45a5c

    • SHA512

      be87282ce45c0dac7c55cc0ba12a28aacb6bf5ad61ce36c32bbe5eb05f883b210ab327608e8a93aecd520b992f6279cfa420cabed5d84f0f66c8736566d645aa

    • SSDEEP

      3072:c2d6mtyOf3YItpGVH1/W92Ve/eV+9wdLxwafS8e8hq:x6mtyOgItpGgD/eUmZS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks