redline | cb75c635646eefd4968b22a2daf07a4197278a4c10271b5d56618199dcf0f46d

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24/09/2023, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 382KB
Sample230924-e65hhsea77
SHA256 cb75c635646eefd4968b22a2daf07a4197278a4c10271b5d56618199dcf0f46d
MD5 60170cf6afe86e47050d017401235afe
SHA1 6f3f2baf9f569b38f1b7a675d7fe16102a65fd2e
SHA512 6cbdfe944efdef6cfd1cc073c219bded2a530c79373d6102735298e6ad34bf4547f394920eeacbac73101ba00006171ea06e871e01aeba3634f51460ba924a50
SSDEEP 6144:PWAXnWyMhuCAA11eRNCYt0uAOph4dNs2Owb7yT2lWthF33dfSRMdWw8y:Pn3VMhRAUWCuQqcDlGf2xw8y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

194.169.175.232:45451

Attributes

auth_value
277a7742ea9b1da2a636fb11c1abcacd

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1792	1672	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1672	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1792	AppLaunch.exe
1792	AppLaunch.exe
1792	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1792	1672	file.exe	28
PID 1672 wrote to memory of 1940	1672	file.exe	29
PID 1672 wrote to memory of 1940	1672	file.exe	29
PID 1672 wrote to memory of 1940	1672	file.exe	29
PID 1672 wrote to memory of 1940	1672	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 52
  2⤵
  - Program crash
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-1-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-2-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-3-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1792-5-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-9-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-7-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1792-10-0x0000000074500000-0x0000000074BEE000-memory.dmp

Download

memory/1792-11-0x00000000002A0000-0x00000000002A6000-memory.dmp

Download

memory/1792-12-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Download

memory/1792-13-0x0000000074500000-0x0000000074BEE000-memory.dmp

Download

memory/1792-14-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Download

memory/1792-15-0x0000000074500000-0x0000000074BEE000-memory.dmp

Download