redline | feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36

Analysis

max time kernel
136s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe
Size 951KB
Sample240809-kkd2bsycpj
SHA256 feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36
MD5 e530d19a769bcd90ec3e92ebf08d68e9
SHA1 ba44d592474de8fdb853f25fb364fe14a4779f74
SHA512 36e0b6fac19955bc2cc7c629f34577d1b0897ba4b551b5b0db3c8aec62c9ee92c15b7e1d953d79a3d6b428a31b816b7a410a2b62542d7260d97b22306e9b8f67
SSDEEP 24576:VouY8YFDfePwag4UuD8fb12btPSMAs+10lDgJHuA:tYZBW4uD8fxstPSMAP10lD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

147.45.44.139:31598

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/764-27-0x0000000000B90000-0x0000000000BE2000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1664 created 3280	1664	Instrumental.pif	52

Executes dropped EXE 2 IoCs

pid	Process
1664	Instrumental.pif
764	RegAsm.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3756	tasklist.exe
3408	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\VisitorPage	feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Instrumental.pif

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	tasklist.exe
Token: SeDebugPrivilege	3408	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1664	Instrumental.pif
1664	Instrumental.pif
1664	Instrumental.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 3768	1000	feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe	81
PID 1000 wrote to memory of 3768	1000	feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe	81
PID 1000 wrote to memory of 3768	1000	feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe	81
PID 3768 wrote to memory of 3756	3768	cmd.exe	84
PID 3768 wrote to memory of 3756	3768	cmd.exe	84
PID 3768 wrote to memory of 3756	3768	cmd.exe	84
PID 3768 wrote to memory of 236	3768	cmd.exe	85
PID 3768 wrote to memory of 236	3768	cmd.exe	85
PID 3768 wrote to memory of 236	3768	cmd.exe	85
PID 3768 wrote to memory of 3408	3768	cmd.exe	87
PID 3768 wrote to memory of 3408	3768	cmd.exe	87
PID 3768 wrote to memory of 3408	3768	cmd.exe	87
PID 3768 wrote to memory of 1128	3768	cmd.exe	88
PID 3768 wrote to memory of 1128	3768	cmd.exe	88
PID 3768 wrote to memory of 1128	3768	cmd.exe	88
PID 3768 wrote to memory of 2972	3768	cmd.exe	89
PID 3768 wrote to memory of 2972	3768	cmd.exe	89
PID 3768 wrote to memory of 2972	3768	cmd.exe	89
PID 3768 wrote to memory of 2336	3768	cmd.exe	90
PID 3768 wrote to memory of 2336	3768	cmd.exe	90
PID 3768 wrote to memory of 2336	3768	cmd.exe	90
PID 3768 wrote to memory of 4708	3768	cmd.exe	91
PID 3768 wrote to memory of 4708	3768	cmd.exe	91
PID 3768 wrote to memory of 4708	3768	cmd.exe	91
PID 3768 wrote to memory of 1664	3768	cmd.exe	92
PID 3768 wrote to memory of 1664	3768	cmd.exe	92
PID 3768 wrote to memory of 1664	3768	cmd.exe	92
PID 3768 wrote to memory of 1968	3768	cmd.exe	93
PID 3768 wrote to memory of 1968	3768	cmd.exe	93
PID 3768 wrote to memory of 1968	3768	cmd.exe	93
PID 1664 wrote to memory of 764	1664	Instrumental.pif	95
PID 1664 wrote to memory of 764	1664	Instrumental.pif	95
PID 1664 wrote to memory of 764	1664	Instrumental.pif	95
PID 1664 wrote to memory of 764	1664	Instrumental.pif	95
PID 1664 wrote to memory of 764	1664	Instrumental.pif	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe
  "C:\Users\Admin\AppData\Local\Temp\feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Kathy Kathy.cmd & Kathy.cmd & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:236
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3408
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 473722
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "LucasAlliedFooGraph" Armor
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Edinburgh + Elliott + Luxembourg + Calm + Circumstances + Holders 473722\f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\473722\Instrumental.pif
      Instrumental.pif f
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1664
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
- C:\Users\Admin\AppData\Local\Temp\473722\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\473722\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Instrumental.pif

Path C:\Users\Admin\AppData\Local\Temp\473722\Instrumental.pif
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\473722\RegAsm.exe
Size 63KB
SHA256 53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b
MD5 42ab6e035df99a43dbb879c86b620b91
SHA1 c6e116569d17d8142dbb217b1f8bfa95bc148c38
SHA512 2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhF++iSMH6Iq8ASYDKCGjW3l:rYMaNylPYSAb8dBnFiH+lDKCGK3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\473722\f
Size 400KB
SHA256 06922a1830ea25238ef27d3e47d18f96a003fda2f5ac166b7134a68b180c2363
MD5 9c49b4a1f3a17bf4e3e1bc660f245e6c
SHA1 12aa8f0438d64b13c9e7d6886c9d431c89e7f95a
SHA512 4f931896327101250c10e3bf0d4c599714adfa73dfba4cf4e5f052d815fb6b11336044ab27e854bbf6d0452e1edb7ddb127c06013538760bc8f52f51d2c84740
SSDEEP 12288:ZHuocEaSUpbgXE+aaAKn28LIYFDMap4qo4agzL4n6Y:ZHudSag0J8MYFDMaWwagzU6Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Armor

Path C:\Users\Admin\AppData\Local\Temp\Armor
Size 393B
SHA256 90ea0b7abbd52a052ff34a28e840821a87f36676952eb89fa50ea813d2ade6ef
MD5 539436411a91ffff5f656b26255c8626
SHA1 671cee8628e8cf7658c2705018203b6c2c77b149
SHA512 52b7926540393f9e82724d7291f438b9a58ea09128821f2847d29fdd9fc6e1334cbae26e093d321abd88052780feee358145379ffa02a6cb3858ab11f94ecab6
MD5 SHA1 SHA512

Submit Download

Calm

Path C:\Users\Admin\AppData\Local\Temp\Calm
Size 55KB
SHA256 3c29f332850330bcebab673d0bd18b3313eacd7576d5cf8effd158169cca4a34
MD5 caf941605fb0c9b10e1ac279eee961ac
SHA1 7d88fee90d42f11540810d458c73dfe41b9ab85c
SHA512 bed8761b7644b505ca45af83391398dd3d303759779e6ba24743cf7681b5053734989a0c0a9fe586da4bfda12e2dda401cd886963d42da2896e65af1561e3227
SSDEEP 768:M+HYYD9Z3IubYJVk+kFcTIFyFBS0XJG+gJXBm3Rrn7WyhZLb/qrWbWy9CIcnZCFV:9HjDLIYFlUi0XJzIen7WyhZ/fWgcIDL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Circumstances

Path C:\Users\Admin\AppData\Local\Temp\Circumstances
Size 90KB
SHA256 3cc341685fded40e7973a6918312e174f7e9ee3c9f3fd32420f2b1cb21109361
MD5 acbcde3c125a72ebd6a2ae8315f50b63
SHA1 9a1548555b64caf4b0f7e2e14a1b30e700c81552
SHA512 98c8b3972715f6f3cd889ac3e7471f667ab98082a1cb5a5eb815665005e7d9e872bb8f2a2acaa97879c85cc797b48d17c86e39feaa3ea72a109928c4994d44bd
SSDEEP 1536:ApWIjQXUCEFFz2o0FzVeCaYa+N8qMFy/9IC1JUX44iNpONdqXu4yRrPWF1WQ9ZP6:Ap8UZ7zWlhNVMFg9l3Uo4iNpONdqXu4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edinburgh

Path C:\Users\Admin\AppData\Local\Temp\Edinburgh
Size 67KB
SHA256 b64170d3071397e910f47f9f298abc22c33841f759b8ee9d999c6a27a2a4a2c0
MD5 a2773a9de9c8deb990a654e343f1258d
SHA1 cc83f93154c2cd956ee2bbd10f974c1db7cd91c8
SHA512 e5787a49fc0ecac8a325774d15c82d2dd27be981b12550a323304a703c7a20e171d08a1a384162a7a37d8e262f8ae7776e01886b845c4d7bf1342ae59da3c164
SSDEEP 1536:5D+MONonbeOJB564wkBY8+gSEyZYJwUp+zJfcjN3zaUjJmldNIC:5DEibHV6ro/SE/8zdUNjaUjclj5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elliott

Path C:\Users\Admin\AppData\Local\Temp\Elliott
Size 67KB
SHA256 3cf292881045f3d50364f423aca2fbd87e6f7339fe8db36568a1dd4b78a0b842
MD5 a9f377ceb60f84537bbaf960970cca82
SHA1 07bc24abaab9953be6018f92566b37f107e908a3
SHA512 3a30429a589776f430442b7cbbba3fb73a9891fb01e469ae59e3ee0479c90052d38223f102d1959b3b32589df8d14c13c55f765572845fbe67f2ea65b251c9fd
SSDEEP 1536:WBjVrLaFKOUdKIIQDQqO6Muto58cLBiVTiRMPJ:WBprLr2IIpbutVc6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Holders

Path C:\Users\Admin\AppData\Local\Temp\Holders
Size 32KB
SHA256 0e1b8db2db7933870edaa0bccdc6a606f6e55597dde8f99638928f91728ea272
MD5 30d6715fcb0d2ecea58ef12c55f47667
SHA1 c9db2ae4074ddb7379bbb4f6839b8321be526fa0
SHA512 9b7e3c1855a300b41ba965a08dfbd396337870121151822b67d1bfe8a2d8aa03d7360952dee799445c2c6ccd93ce58808534f5c891d51761e21f9ce5da0bb44b
SSDEEP 768:w7cF3u8NXQfHL4N36/X01TnsCBwfHRdsEglZlxJvu8lresgN01a:XdNQsZCX01TsCBwfHRd0jBlHC01a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kathy

Path C:\Users\Admin\AppData\Local\Temp\Kathy
Size 13KB
SHA256 d40d6e421976295250834db769af750c92012dcc88dc65507681faf6e4330c19
MD5 c4981f3a5228cb7df18526017be817c6
SHA1 1c3691bfea44a197df09841784cdcaf7cbae3ec5
SHA512 21d3bc72be1b6cab6e0f85a805ab7fde23cc18d856f32b692ad6845f04fad93255b21ebffb2572543c43e8124e9b78fa79ae900bfb7145013fb305bc94d22c01
SSDEEP 384:6ycHejPS9h4hAx/aKlJ/FoeFBdz7pjneNKQOOln1dGV:6yrmFxxlJ/+eZDQKQ/1y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Keeps

Path C:\Users\Admin\AppData\Local\Temp\Keeps
Size 872KB
SHA256 28d4a2a735bf820c7c4e48017ed1c0cbcc9351820fa561861b10f86a0022bf76
MD5 fc1fceed4119e874078b3a5fd502477d
SHA1 cddaf83c2aa7bab873ff8b9e3781c338645c81ac
SHA512 5ec2f9c90500f8d118bc170da95caf09d88bc75f5f1f6d83866c7baa108bfaa74a4fc3d853cdf073430daae68810908514cf02dc4f6c5b5a1675efbcef34760a
SSDEEP 12288:HpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:HT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Luxembourg

Path C:\Users\Admin\AppData\Local\Temp\Luxembourg
Size 89KB
SHA256 11c9db0ee88e1de82a3a745db8d9d6acf23ad120e18cfb308ad5a538c8868f0d
MD5 1c809e014a5fbf2c2782f00fc96140cd
SHA1 4d35a46db91a9cd4118ed05063f5db8adc885e34
SHA512 060e05889fead6912c67f1fcfb7649996a43d86768cd8f0823572884f93fb6bf50bd3fafa5dad7e3509d5e43431c38cee9675e34f89a24d837b7ec440ded7cdb
SSDEEP 1536:beqMzDVY3xm4tuiZwuh81hEy0ZEmYx/dnOe5MwGz1N1Re61Ga3nzPQcCCGB08zwV:beqmC3xm4YyQ+ZEmYH35MwGh061n3nzT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/764-27-0x0000000000B90000-0x0000000000BE2000-memory.dmp

Download

memory/764-30-0x00000000056C0000-0x0000000005C66000-memory.dmp

Download

memory/764-31-0x00000000051B0000-0x0000000005242000-memory.dmp

Download

memory/764-32-0x0000000005340000-0x000000000534A000-memory.dmp

Download

memory/764-33-0x0000000006290000-0x00000000068A8000-memory.dmp

Download

memory/764-34-0x0000000005C70000-0x0000000005D7A000-memory.dmp

Download

memory/764-35-0x0000000005570000-0x0000000005582000-memory.dmp

Download

memory/764-36-0x00000000055D0000-0x000000000560C000-memory.dmp

Download

memory/764-37-0x0000000005620000-0x000000000566C000-memory.dmp

Download