redline | 13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea

General

Target

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
Size

909KB
MD5

b79a3355266f15c8b8a46803aa3d3ce8
SHA1

7bbd35f0b831065e81430349b4377a2f02075cdd
SHA256

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea
SHA512

c2272e1de7130f444c4d6348734e151f1bb308f677554ffea27f665087ada3e9712130bed91267e7c2371c8d82bef70f409a16bd82ae8db58f7c17a5fc87c3c0
SSDEEP

24576:OtASL4DJnNps+2Z3ciTWTn6WHGxju3MELhqb7S+AXOQEZAsS:K4DJnNps+JiTyejB7S+AYBS

Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.115:40551

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4240-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

description	pid	process	target process
PID 1876 set thread context of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3608 1876 WerFault.exe 13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

RegAsm.exe

pid process

4240 RegAsm.exe
4240 RegAsm.exe
4240 RegAsm.exe
4240 RegAsm.exe
4240 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 4240 RegAsm.exe

pid	pid_target	process	target process
3608	1876	WerFault.exe	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

pid	process
4240	RegAsm.exe
4240	RegAsm.exe
4240	RegAsm.exe
4240	RegAsm.exe
4240	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4240	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe

description	pid	process	target process
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe
PID 1876 wrote to memory of 4240	1876	13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe
"C:\Users\Admin\AppData\Local\Temp\13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 272
2⤵
- Program crash
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1876 -ip 1876
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-0-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1876-1-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1876-3-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/4240-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4240-4-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/4240-5-0x0000000005D40000-0x00000000062E6000-memory.dmp

Filesize
5.6MB

Download
memory/4240-6-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/4240-7-0x0000000005820000-0x000000000582A000-memory.dmp

Filesize
40KB

Download
memory/4240-8-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download
memory/4240-9-0x0000000006910000-0x0000000006F28000-memory.dmp

Filesize
6.1MB

Download
memory/4240-11-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

Filesize
72KB

Download
memory/4240-10-0x0000000005BC0000-0x0000000005CCA000-memory.dmp

Filesize
1.0MB

Download
memory/4240-12-0x0000000005B10000-0x0000000005B4C000-memory.dmp

Filesize
240KB

Download
memory/4240-13-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Filesize
304KB

Download
memory/4240-14-0x00000000063B0000-0x0000000006416000-memory.dmp

Filesize
408KB

Download
memory/4240-15-0x00000000071C0000-0x0000000007210000-memory.dmp

Filesize
320KB

Download
memory/4240-16-0x00000000075E0000-0x00000000077A2000-memory.dmp

Filesize
1.8MB

Download
memory/4240-17-0x0000000007CE0000-0x000000000820C000-memory.dmp

Filesize
5.2MB

Download
memory/4240-19-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads