redline | 13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea

General

Target

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
Size

909KB
MD5

b79a3355266f15c8b8a46803aa3d3ce8
SHA1

7bbd35f0b831065e81430349b4377a2f02075cdd
SHA256

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea
SHA512

c2272e1de7130f444c4d6348734e151f1bb308f677554ffea27f665087ada3e9712130bed91267e7c2371c8d82bef70f409a16bd82ae8db58f7c17a5fc87c3c0
SSDEEP

24576:OtASL4DJnNps+2Z3ciTWTn6WHGxju3MELhqb7S+AXOQEZAsS:K4DJnNps+JiTyejB7S+AYBS

Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.115:40551

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5728-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

description	pid	process	target process
PID 5796 set thread context of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5388 5796 WerFault.exe 13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

RegAsm.exe

pid process

5728 RegAsm.exe
5728 RegAsm.exe
5728 RegAsm.exe
5728 RegAsm.exe
5728 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 5728 RegAsm.exe

pid	pid_target	process	target process
5388	5796	WerFault.exe	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

pid	process
5728	RegAsm.exe
5728	RegAsm.exe
5728	RegAsm.exe
5728	RegAsm.exe
5728	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	5728	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

description	pid	process	target process
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 5796 wrote to memory of 5728	5796	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
"C:\Users\Admin\AppData\Local\Temp\13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 284
  2⤵
  - Program crash
  PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5796 -ip 5796
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5728-8-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/5728-19-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/5728-9-0x0000000005FB0000-0x00000000065C8000-memory.dmp

Filesize
6.1MB

Download
memory/5728-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5728-4-0x000000007452E000-0x000000007452F000-memory.dmp

Filesize
4KB

Download
memory/5728-5-0x00000000053E0000-0x0000000005984000-memory.dmp

Filesize
5.6MB

Download
memory/5728-6-0x0000000004ED0000-0x0000000004F62000-memory.dmp

Filesize
584KB

Download
memory/5728-7-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

Filesize
40KB

Download
memory/5728-17-0x0000000007390000-0x00000000078BC000-memory.dmp

Filesize
5.2MB

Download
memory/5728-16-0x0000000006C90000-0x0000000006E52000-memory.dmp

Filesize
1.8MB

Download
memory/5728-11-0x0000000005140000-0x0000000005152000-memory.dmp

Filesize
72KB

Download
memory/5728-10-0x0000000005230000-0x000000000533A000-memory.dmp

Filesize
1.0MB

Download
memory/5728-12-0x00000000051A0000-0x00000000051DC000-memory.dmp

Filesize
240KB

Download
memory/5728-13-0x00000000051E0000-0x000000000522C000-memory.dmp

Filesize
304KB

Download
memory/5728-14-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/5728-15-0x0000000006830000-0x0000000006880000-memory.dmp

Filesize
320KB

Download
memory/5796-1-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/5796-3-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/5796-0-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads