redline | 9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1

General

Target

9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe
Size

6.5MB
MD5

682e25cf5897e24f3a31f21741fb0f11
SHA1

d9b228b9b20f3397514d3f12b67ad42e166cab39
SHA256

9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1
SHA512

1313b05abe9c79863856eabdc60a228ad320d8e4928758c072b33b1735418b309489d05c70b9e86a08280efa4f9a0af8f9ebf307630392a3088fdb97c15efe98
SSDEEP

196608:pbnyiVLkzy7SuxwY4YaWJJulOpH5mZHi8Lr+g2qyeOQr7tlW7FT29y7q2wMyQcaS:pyRX674+j+

Score

10^/10

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/1980-0-0x0000000000370000-0x0000000000A00000-memory.dmp	family_zgrat_v1
behavioral2/memory/4384-21-0x0000000000400000-0x00000000004C2000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4384-21-0x0000000000400000-0x00000000004C2000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4384	MsBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	MsBuild.exe
Token: SeBackupPrivilege	4384	MsBuild.exe
Token: SeSecurityPrivilege	4384	MsBuild.exe
Token: SeSecurityPrivilege	4384	MsBuild.exe
Token: SeSecurityPrivilege	4384	MsBuild.exe
Token: SeSecurityPrivilege	4384	MsBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4988	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	73
PID 1980 wrote to memory of 4988	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	73
PID 1980 wrote to memory of 4988	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	73
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74
PID 1980 wrote to memory of 4384	1980	9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe	74

C:\Users\Admin\AppData\Local\Temp\9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe
"C:\Users\Admin\AppData\Local\Temp\9978122d8b90575e7bfeb09cba339e5c6336d852724a37dc2b4d4de6813696d1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TmpFE84.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/1980-23-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-0-0x0000000000370000-0x0000000000A00000-memory.dmp

Filesize
6.6MB

Download
memory/1980-4-0x0000000005730000-0x00000000058C2000-memory.dmp

Filesize
1.6MB

Download
memory/1980-2-0x0000000005250000-0x00000000052EC000-memory.dmp

Filesize
624KB

Download
memory/1980-10-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-12-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-11-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-13-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/1980-16-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-15-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-1-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-17-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-18-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

Filesize
1024KB

Download
memory/1980-19-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

Filesize
1024KB

Download
memory/1980-20-0x0000000005BE0000-0x0000000005CE0000-memory.dmp

Filesize
1024KB

Download
memory/1980-14-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1980-3-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download
memory/4384-24-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download
memory/4384-49-0x0000000008C00000-0x0000000008D0A000-memory.dmp

Filesize
1.0MB

Download
memory/4384-26-0x00000000053B0000-0x0000000005442000-memory.dmp

Filesize
584KB

Download
memory/4384-27-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4384-28-0x0000000005460000-0x000000000546A000-memory.dmp

Filesize
40KB

Download
memory/4384-25-0x00000000059B0000-0x0000000005EAE000-memory.dmp

Filesize
5.0MB

Download
memory/4384-45-0x0000000008070000-0x00000000080E6000-memory.dmp

Filesize
472KB

Download
memory/4384-46-0x00000000086A0000-0x00000000086BE000-memory.dmp

Filesize
120KB

Download
memory/4384-48-0x0000000009090000-0x0000000009696000-memory.dmp

Filesize
6.0MB

Download
memory/4384-21-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4384-50-0x0000000008B50000-0x0000000008B62000-memory.dmp

Filesize
72KB

Download
memory/4384-51-0x0000000008BB0000-0x0000000008BEE000-memory.dmp

Filesize
248KB

Download
memory/4384-52-0x0000000008D10000-0x0000000008D5B000-memory.dmp

Filesize
300KB

Download
memory/4384-53-0x0000000008E50000-0x0000000008EB6000-memory.dmp

Filesize
408KB

Download
memory/4384-56-0x000000000A4D0000-0x000000000A692000-memory.dmp

Filesize
1.8MB

Download
memory/4384-57-0x000000000ABD0000-0x000000000B0FC000-memory.dmp

Filesize
5.2MB

Download
memory/4384-59-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing