redline | 79f97ade11408fff0371a3a995a783c35b19a026b7513c577f2eea4eebfef79c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.1MB
Sample231012-rhbazsff33
SHA256 79f97ade11408fff0371a3a995a783c35b19a026b7513c577f2eea4eebfef79c
MD5 3b83e82a0e0decf4f1bc8a7ebe74add6
SHA1 06d863a461c3b3370e50bb7017ad8f2303420088
SHA512 44d21e769f12bc06b60e543c76fb20d5e2a0cda25fbd1ec3d42323946e8e76918ac5101ec4e10d94d56aee59a87817336bcfefb36d6bdc8ee1f3fcff5465f3ac
SSDEEP 24576:wJYRIZ02Fi3EGHdri6CiDpwWi7FEA3UU:+02Fi3EMdri6nwWXA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline unique285 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

unique285

194.169.175.232:45451

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral1/memory/2636-4-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2636-6-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2636-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2636-11-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2636-13-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2636-15-0x00000000074F0000-0x0000000007530000-memory.dmp	family_redline
behavioral1/memory/2636-17-0x00000000074F0000-0x0000000007530000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 2636	1824	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	1824	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2636	AppLaunch.exe
2636	AppLaunch.exe
2636	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2636	1824	file.exe	29
PID 1824 wrote to memory of 2740	1824	file.exe	30
PID 1824 wrote to memory of 2740	1824	file.exe	30
PID 1824 wrote to memory of 2740	1824	file.exe	30
PID 1824 wrote to memory of 2740	1824	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 52
  2⤵
  - Program crash
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-4-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2636-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2636-14-0x0000000073B90000-0x000000007427E000-memory.dmp

Download

memory/2636-15-0x00000000074F0000-0x0000000007530000-memory.dmp

Download

memory/2636-16-0x0000000073B90000-0x000000007427E000-memory.dmp

Download

memory/2636-17-0x00000000074F0000-0x0000000007530000-memory.dmp

Download

memory/2636-18-0x0000000073B90000-0x000000007427E000-memory.dmp

Download