redline | cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d

Analysis

max time kernel
188s
max time network
294s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
25/09/2023, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe
Size 413KB
Sample230925-ffgjfacc5y
SHA256 cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d
MD5 5c5eb6489ecad14a5161afa90f965adc
SHA1 6922636c390d47f9a77dd30a1ef20a91a369587f
SHA512 46c7d4f26a742d793bf26d430e6f185b2de8f5b7c6a6f7cf0c2bf14d971591c23cc2537341174548f7cfb3a1bc216d14ef95c9008a4bad068b8c8323ecdcdd1c
SSDEEP 6144:Ql8hbVeadz9+w/SZHOCu5gRuAO7EUUUUUUMTATsrJ8qefuHvK+APAHqwC:QlCReadAweueu1zVefuK+APZwC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

146.59.10.173:45035

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1500	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3268	AppLaunch.exe
3268	AppLaunch.exe
3268	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4020	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	70
PID 1500 wrote to memory of 4020	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	70
PID 1500 wrote to memory of 4020	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	70
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71
PID 1500 wrote to memory of 3268	1500	cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe	71

C:\Users\Admin\AppData\Local\Temp\cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe
"C:\Users\Admin\AppData\Local\Temp\cd0a41dd6a4877a00dce17561da67e03b99a6d88886be9b4b035735d16f1429d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 228
  2⤵
  - Program crash
  PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3268-4-0x00000000731E0000-0x00000000738CE000-memory.dmp

Download

memory/3268-5-0x0000000006960000-0x0000000006966000-memory.dmp

Download

memory/3268-6-0x000000000E9B0000-0x000000000EFB6000-memory.dmp

Download

memory/3268-7-0x000000000E4F0000-0x000000000E5FA000-memory.dmp

Download

memory/3268-9-0x000000000E420000-0x000000000E432000-memory.dmp

Download

memory/3268-8-0x0000000009010000-0x0000000009020000-memory.dmp

Download

memory/3268-10-0x000000000E480000-0x000000000E4BE000-memory.dmp

Download

memory/3268-11-0x000000000E600000-0x000000000E64B000-memory.dmp

Download

memory/3268-16-0x000000000E7A0000-0x000000000E816000-memory.dmp

Download

memory/3268-17-0x000000000E8C0000-0x000000000E952000-memory.dmp

Download

memory/3268-18-0x000000000F4C0000-0x000000000F9BE000-memory.dmp

Download

memory/3268-21-0x000000000EFC0000-0x000000000F026000-memory.dmp

Download

memory/3268-22-0x00000000731E0000-0x00000000738CE000-memory.dmp

Download

memory/3268-269-0x000000000FC90000-0x000000000FE52000-memory.dmp

Download

memory/3268-270-0x0000000010390000-0x00000000108BC000-memory.dmp

Download

memory/3268-283-0x0000000009010000-0x0000000009020000-memory.dmp

Download

memory/3268-392-0x000000000FC40000-0x000000000FC90000-memory.dmp

Download

memory/3268-403-0x00000000731E0000-0x00000000738CE000-memory.dmp

Download