redline | cbf7d9a996e468305ef104f80f50d6f6b4208223b199deb8011919e5ce607d9c

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5CFCF21174BE2024EE356D7219BC5C17.exe
Size 1.1MB
Sample240116-vs4xtsfden
SHA256 cbf7d9a996e468305ef104f80f50d6f6b4208223b199deb8011919e5ce607d9c
MD5 5cfcf21174be2024ee356d7219bc5c17
SHA1 9bba45f158736e06b9907c008b6fd5a81bd8f0d0
SHA512 e80830a87e6cc3cdcf16a225d2c42b7d5e4213bba3e97380734552a4298b245e7f69b94c6fc2f86fe88fa8638ad7145bfe67408fd16e762a7c466739c7a7e68f
SSDEEP 24576:9Kf67Ko7B0Q9sNbv3CQg6JZUza/lXYAcLXqSB71qOLtfzQo8:9US97B3UCCJtX85B7Ma1M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline seo2 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

seo2

185.242.86.221:1523

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/708-36-0x0000000000700000-0x0000000000752000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4452 created 3364	4452	Herein.pif	30

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	5CFCF21174BE2024EE356D7219BC5C17.exe

Executes dropped EXE 2 IoCs

pid	Process
4452	Herein.pif
708	jsc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3084	tasklist.exe
3656	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2392	PING.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif
708	jsc.exe
708	jsc.exe
708	jsc.exe
708	jsc.exe
708	jsc.exe
708	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	tasklist.exe
Token: SeDebugPrivilege	3656	tasklist.exe
Token: SeDebugPrivilege	708	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4452	Herein.pif
4452	Herein.pif
4452	Herein.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4220	444	5CFCF21174BE2024EE356D7219BC5C17.exe	89
PID 444 wrote to memory of 4220	444	5CFCF21174BE2024EE356D7219BC5C17.exe	89
PID 444 wrote to memory of 4220	444	5CFCF21174BE2024EE356D7219BC5C17.exe	89
PID 4220 wrote to memory of 1600	4220	cmd.exe	91
PID 4220 wrote to memory of 1600	4220	cmd.exe	91
PID 4220 wrote to memory of 1600	4220	cmd.exe	91
PID 1600 wrote to memory of 3084	1600	cmd.exe	92
PID 1600 wrote to memory of 3084	1600	cmd.exe	92
PID 1600 wrote to memory of 3084	1600	cmd.exe	92
PID 1600 wrote to memory of 1568	1600	cmd.exe	93
PID 1600 wrote to memory of 1568	1600	cmd.exe	93
PID 1600 wrote to memory of 1568	1600	cmd.exe	93
PID 1600 wrote to memory of 3656	1600	cmd.exe	95
PID 1600 wrote to memory of 3656	1600	cmd.exe	95
PID 1600 wrote to memory of 3656	1600	cmd.exe	95
PID 1600 wrote to memory of 2768	1600	cmd.exe	96
PID 1600 wrote to memory of 2768	1600	cmd.exe	96
PID 1600 wrote to memory of 2768	1600	cmd.exe	96
PID 1600 wrote to memory of 4992	1600	cmd.exe	97
PID 1600 wrote to memory of 4992	1600	cmd.exe	97
PID 1600 wrote to memory of 4992	1600	cmd.exe	97
PID 1600 wrote to memory of 5072	1600	cmd.exe	98
PID 1600 wrote to memory of 5072	1600	cmd.exe	98
PID 1600 wrote to memory of 5072	1600	cmd.exe	98
PID 1600 wrote to memory of 3260	1600	cmd.exe	99
PID 1600 wrote to memory of 3260	1600	cmd.exe	99
PID 1600 wrote to memory of 3260	1600	cmd.exe	99
PID 1600 wrote to memory of 4452	1600	cmd.exe	100
PID 1600 wrote to memory of 4452	1600	cmd.exe	100
PID 1600 wrote to memory of 4452	1600	cmd.exe	100
PID 1600 wrote to memory of 2392	1600	cmd.exe	101
PID 1600 wrote to memory of 2392	1600	cmd.exe	101
PID 1600 wrote to memory of 2392	1600	cmd.exe	101
PID 4452 wrote to memory of 708	4452	Herein.pif	109
PID 4452 wrote to memory of 708	4452	Herein.pif	109
PID 4452 wrote to memory of 708	4452	Herein.pif	109
PID 4452 wrote to memory of 708	4452	Herein.pif	109
PID 4452 wrote to memory of 708	4452	Herein.pif	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Temp\5CFCF21174BE2024EE356D7219BC5C17.exe
  "C:\Users\Admin\AppData\Local\Temp\5CFCF21174BE2024EE356D7219BC5C17.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k cmd < Graham & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:1568
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe"
        5⤵
        
        PID:2768
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 17963
        5⤵
        
        PID:4992
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Unified + Blackjack + Streets + Tax + Mastercard + Celebs 17963\Herein.pif
        5⤵
        
        PID:5072
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Removed + Owner 17963\O
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\Herein.pif
        
        17963\Herein.pif 17963\O
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4452
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:2392
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\jsc.exe
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\jsc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Herein.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\Herein.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\O
Size 666KB
SHA256 0f56e4319a6e4bb7149f2cc95b38f27ecb7fd1d9262d46b221882260ec2ce914
MD5 2ea7ae30857a7d587a677a33e70c3430
SHA1 937792ab685a47932982d4de788fa0acacfa52f0
SHA512 42aafdf468c178815ab1bb326eb94f3009520fe6187f6f70920587be5c21ec04bf532b02c9a1f8d5fc15c69d7b3faf5b981eb287f02acba36b225b50219f7dfa
SSDEEP 6144:LhiCMtTRvxVhdIvhCetaCXyLA2ptO14mVlySDZEDlIEU1WFtPu2lGj1AVCfTbCPU:li5/VhdEyEemFFE1XtW2lsnXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsc.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\17963\jsc.exe
Size 46KB
SHA256 39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5
MD5 94c8e57a80dfca2482dedb87b93d4fd9
SHA1 5729e6c7d2f5ab760f0093b9d44f8ac0f876a803
SHA512 1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc
SSDEEP 768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Blackjack

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Blackjack
Size 202KB
SHA256 59e2e02c06ff7420e6ea7ae30cd41814a83c4aee0f8a11344cb80e843a7c49c7
MD5 e1e70c732dc632a6527ae6b674c9214d
SHA1 3e9998fea2fbd2bed379204c803fe16572b5726a
SHA512 dd5c83bd39b7c42ecf22315d12c3ef0fd0076a6f423fa79392a9e88c89768d2b3586aa20c3d6e4890d0e331b3b3e76886961e59d5e31366977517cc94fba3afd
SSDEEP 6144:fqd12lqlEAehuqN8zwNzlmhPL1b5nZ2tZ6lfAT:fqClqlEZuB1b5Z2tZ6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Celebs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Celebs
Size 43KB
SHA256 04f1b50a94b2a6b267bab78b56eeecc9095faf904a05c669fb52803c585e5879
MD5 f68425c29a0fed4c53d24ef92d90c646
SHA1 d385b10313b79f49b4725db51235d2012a867b00
SHA512 b66d613823fddc9eaa31dc3781548bbcf2acd68d03d7043d9515fd631c34331d7f4339ea18e6d571d629168bc7521832474971f3497f4024b8c3b564927d63c7
SSDEEP 768:I9BkxXNHMi0O0GmpefKSlgaJyc3rE2UWb/hMjFQTVat3VEV3GPkjI:I9BkxXiblenlJJyIE2UWb/hoQZ2OE3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Graham

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Graham
Size 12KB
SHA256 8d9b0437a7872c415285ddded6bf7a334d211e72912e75497e62f92c036b60b2
MD5 e44274408b32bb74f5cbc5078024ef13
SHA1 018e6f33d0accb253b98628021fbec3d787e8e6f
SHA512 b586ccdea00dbc11bb345f7423481237fe44bd7330958ec4516585c5d2bf80d82bd086fe9832984907b6577bbbf185a142cbb7e616e6c535d3b44b9516494791
SSDEEP 384:dv/yqbWB/XsBNzLnYk15v5z52b5kX/sLy5ZR5kX/WJzWuaIeaRA3mK:dJWdXsPzLnYk15v5z52b5kX/sLy5ZR5+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mastercard

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mastercard
Size 207KB
SHA256 93a4f1ce66757c63cb962606b2228708cea346a036222c3b9827f0e4ebdda6be
MD5 f4171183cb1825c160df39ac286e77ad
SHA1 5cabf83b8c1b21f582bd27d361e7d38b0e0d5945
SHA512 3c813edf38bd92bbb35ab697455510b82553b4b3180ae859372bde545cc957f944f7a7888784afdf7254b460898994502943bc4f7c834548276e71afbd9a01e9
SSDEEP 3072:p08XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZN:p04pmdV364EgarxUaBZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Owner

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Owner
Size 171KB
SHA256 5557a6c3d8e28f93d705c66381b354a3748a73de90c418036b1d49376d5960ee
MD5 bbd5414bf6bb3013e67fa5bcf848b9df
SHA1 d6c43b68beed052a05ba855371ca6f9c064ddda9
SHA512 55596de5d16e5b08dd21176d07694e6013738229f223f6341e208ad9b092bf23ab41affaea066df7c637eedca84e715bdc5db93ee1c47b129089974a337f59fb
SSDEEP 1536:xF1jrol7TA6pBgfwcievcoOPbbL0sutVErWMok7pCLR2ICZc19VTGVKK4ZIgyC4f:Bfwj1AVCDzCMwebgxPGzH5a4sCftOxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Removed

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Removed
Size 495KB
SHA256 af10c0827ea8554364fecaca1ba919960039cc6c688c7bfa4bd011130375a786
MD5 460e3f5ad993a6ecd04797ab03906030
SHA1 1b32a11a70e0b4d705f158b15d0c262a8b5f7999
SHA512 f3a1e66f13ee86469bd9ccd041c254f79244e84ba31d4496e4363f07c0a21c82fb2ca80bb07b30d2ede099514c7cdb2b0ee85f04dbad311362b805eb0a3bc646
SSDEEP 6144:LhiCMtTRvxVhdIvhCetaCXyLA2ptO14mVlySDZEDlIEU1WFtPu2lH:li5/VhdEyEemFFE1XtW2lH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Streets

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Streets
Size 142KB
SHA256 3326ace0ed6b36100a186a6df9ffcd4d827399f9e35865cd653c90505fc95eab
MD5 8a63d548e4785d47aa3cebdbc7cb8c28
SHA1 914fe07d7dd288543e422556885333cfa9d7ca0e
SHA512 618f8ab9fffa4bd7f15e6bbab6de37c068671db96b3337bbac65911b1dd7896ae0d952f08ac1e562ec483ae357573def4007b2357152dc2a56e300e1220c076d
SSDEEP 3072:mGfza6iyY5tVGvH7fsUQwHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyT7:mGfm608DsvqJX4xNAB+xHFq9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tax

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tax
Size 117KB
SHA256 18cb34f3723b709f8f56c8b4c514c5be00583f0cd80299e12539a827ef295b53
MD5 3ba32752bc53dd28a76c8351adb73f25
SHA1 aac16fae889e5cad90a542d41b73deb554e4627d
SHA512 c2faebaa86dee204478fda09605f57e10a2c58efbf967c6c24db25880261abbe7102bc61e42e501c6b8ff6ee71b80498044cdc1e5cb008aee1e39cf23c1a7a3c
SSDEEP 3072:s0ltj0EowPOGU6WS2uLhxjRYH/fA9vtqmcCVs5A3q5eAg0Fux:s0lHPOGUWLhxjRYmFqZvEAOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unified

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Unified
Size 213KB
SHA256 fc141ffe6bf256b8794c769feed25fa8bfeff01a60cdd2699e2d84e94585553c
MD5 e9db611974409fb7c1770fe95bfd5402
SHA1 ad077d6f8ad48bd4a8edbca88711cc4b7c71c1b5
SHA512 623694fdcc7acd66ed8170a158d2209706311566e04629c5a03b133902f729a554c3aaa6c85ef1163edaa3dfafd72d85b49f6edfa73e5419e57fac1d2f489799
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4m:LO0z8e0lvSr0Wyw20K4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/708-39-0x0000000073070000-0x0000000073820000-memory.dmp

Download

memory/708-46-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Download

memory/708-54-0x0000000073070000-0x0000000073820000-memory.dmp

Download

memory/708-40-0x0000000005380000-0x0000000005924000-memory.dmp

Download

memory/708-41-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Download

memory/708-42-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/708-43-0x0000000004D60000-0x0000000004D6A000-memory.dmp

Download

memory/708-44-0x0000000005F50000-0x0000000006568000-memory.dmp

Download

memory/708-45-0x00000000050B0000-0x00000000051BA000-memory.dmp

Download

memory/708-36-0x0000000000700000-0x0000000000752000-memory.dmp

Download

memory/708-47-0x0000000005040000-0x000000000507C000-memory.dmp

Download

memory/708-48-0x00000000051C0000-0x000000000520C000-memory.dmp

Download

memory/708-49-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/708-50-0x0000000006840000-0x0000000006890000-memory.dmp

Download

memory/708-51-0x0000000008A10000-0x0000000008BD2000-memory.dmp

Download

memory/708-52-0x0000000009110000-0x000000000963C000-memory.dmp

Download

memory/4452-34-0x0000000004200000-0x0000000004201000-memory.dmp

Download