redline | 9dce80f85a97e75765dfac0a48e0c1cc59528ecb2bebb6e8a07e3e9e7bc5420f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 337KB
Sample231016-hpsdeacc5x
SHA256 9dce80f85a97e75765dfac0a48e0c1cc59528ecb2bebb6e8a07e3e9e7bc5420f
MD5 f3b31dd709f3338f9fc807b8560232b1
SHA1 1283764272f9e3d197927a1b98e0e7ccd244310b
SHA512 beca526759ab720e88baa06cd3d665a866fb2d89732c3b6f0d2b601e838e51bd1e361e736c6897aa5611cb4aea355c63e39a5edbdd6c2e6c32a7b62757a351f1
SSDEEP 6144:bZEe3bpi5aaYcqYfgcm7RT0nARu+4IoHH3RcBunSrb6I8TJn:bZEe3zYfdWS+2H9ndI8TJn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline build285 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

build285

194.169.175.232:45451

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/3040-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/3040-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/3040-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/3040-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1196 set thread context of 3040	1196	file.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1196	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3040	AppLaunch.exe
3040	AppLaunch.exe
3040	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	AppLaunch.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3020	1196	file.exe	29
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 3040	1196	file.exe	30
PID 1196 wrote to memory of 2392	1196	file.exe	31
PID 1196 wrote to memory of 2392	1196	file.exe	31
PID 1196 wrote to memory of 2392	1196	file.exe	31
PID 1196 wrote to memory of 2392	1196	file.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 80
  2⤵
  - Program crash
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-1-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-3-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/3040-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-10-0x0000000074380000-0x0000000074A6E000-memory.dmp

Download

memory/3040-11-0x0000000000850000-0x0000000000890000-memory.dmp

Download

memory/3040-12-0x0000000074380000-0x0000000074A6E000-memory.dmp

Download

memory/3040-13-0x0000000074380000-0x0000000074A6E000-memory.dmp

Download