redline | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b

Analysis

max time kernel
186s
max time network
299s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
28/09/2023, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe
Size 381KB
Sample230928-eellbshb86
SHA256 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b
MD5 91bcd7b719ed166914dccdca25b28e14
SHA1 2cc7758c97bbe851cadcdbd6a3158358b690d97f
SHA512 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0
SSDEEP 6144:8OCalXui16lr+3jHBwDp6mAOzZ34C76of+RlSOISDvP5XM3viKC:8Ozui16lrgmlheof+RQ6P5XGiKC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

146.59.10.173:45035

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 420 set thread context of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	420	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4992	AppLaunch.exe
4992	AppLaunch.exe
4992	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 1528	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	70
PID 420 wrote to memory of 1528	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	70
PID 420 wrote to memory of 1528	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	70
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71
PID 420 wrote to memory of 4992	420	76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe	71

C:\Users\Admin\AppData\Local\Temp\76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe
"C:\Users\Admin\AppData\Local\Temp\76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 148
  2⤵
  - Program crash
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4992-4-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download

memory/4992-5-0x00000000094C0000-0x00000000094C6000-memory.dmp

Download

memory/4992-6-0x000000000F010000-0x000000000F616000-memory.dmp

Download

memory/4992-7-0x000000000EB10000-0x000000000EC1A000-memory.dmp

Download

memory/4992-8-0x0000000009570000-0x0000000009580000-memory.dmp

Download

memory/4992-9-0x000000000EA40000-0x000000000EA52000-memory.dmp

Download

memory/4992-10-0x000000000EAA0000-0x000000000EADE000-memory.dmp

Download

memory/4992-11-0x000000000EC20000-0x000000000EC6B000-memory.dmp

Download

memory/4992-16-0x000000000EDC0000-0x000000000EE36000-memory.dmp

Download

memory/4992-17-0x000000000EEE0000-0x000000000EF72000-memory.dmp

Download

memory/4992-18-0x000000000EE40000-0x000000000EEA6000-memory.dmp

Download

memory/4992-19-0x000000000FF20000-0x000000001041E000-memory.dmp

Download

memory/4992-22-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download

memory/4992-27-0x0000000010420000-0x00000000105E2000-memory.dmp

Download

memory/4992-28-0x0000000010B20000-0x000000001104C000-memory.dmp

Download

memory/4992-145-0x000000000FCC0000-0x000000000FD10000-memory.dmp

Download

memory/4992-396-0x0000000009570000-0x0000000009580000-memory.dmp

Download

memory/4992-403-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download