redline | 1c52f54e963b189b2d1e2999f88f24b667b4d65c83875541019a96d96117292b

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
Size 173KB
Sample241109-ykff2stmem
SHA256 160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2
MD5 1e2802760f0b07c1290456694ebf5423
SHA1 9a3a72436ac7d49aeedad5b4eae74173cd8dcb41
SHA512 197882aa57c2dba7a827f3d0b04428c9d31c09a184b51a0f4dac9a6d47e6127a02fec195d2ac96d72bd8726917e360c985ea698c55e5b45b065f6b8dd0e19b0f
SSDEEP 3072:7TQnFeJSrE+G7HRT+rnnDdSzOXueSX5xU5vcOdJRY8pvNBGxEYTlzCS/u:75MrER4nnhyOXs5xETdJRY8ZNBGnXu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @moriwws discovery infostealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
bde556419603fef0058cbd9e9dcab2a2

Extracted

Family

redline

Botnet

@moriwWs

tininshassama.xyz:81

Attributes

auth_value
c2f987b4e6cd55ad1315311e92563eca

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/memory/5112-20-0x0000000000400000-0x000000000043A000-memory.dmp	family_redline
behavioral2/memory/1836-26-0x0000000000800000-0x0000000000828000-memory.dmp	family_redline
behavioral2/memory/5112-31-0x0000000000400000-0x000000000043A000-memory.dmp	family_redline
behavioral2/memory/4204-21-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe

Executes dropped EXE 2 IoCs

pid	Process
5112	S.EXE
1932	V.EXE

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 4204	1932	V.EXE	87
PID 5112 set thread context of 1836	5112	S.EXE	88

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1300-0-0x0000000000D80000-0x0000000000E02000-memory.dmp	upx
behavioral2/memory/1300-16-0x0000000000D80000-0x0000000000E02000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	V.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 5112	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	83
PID 1300 wrote to memory of 5112	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	83
PID 1300 wrote to memory of 5112	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	83
PID 1300 wrote to memory of 1932	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	84
PID 1300 wrote to memory of 1932	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	84
PID 1300 wrote to memory of 1932	1300	160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe	84
PID 5112 wrote to memory of 1836	5112	S.EXE	88
PID 5112 wrote to memory of 1836	5112	S.EXE	88
PID 5112 wrote to memory of 1836	5112	S.EXE	88
PID 1932 wrote to memory of 4204	1932	V.EXE	87
PID 1932 wrote to memory of 4204	1932	V.EXE	87
PID 1932 wrote to memory of 4204	1932	V.EXE	87
PID 1932 wrote to memory of 4204	1932	V.EXE	87
PID 1932 wrote to memory of 4204	1932	V.EXE	87
PID 5112 wrote to memory of 1836	5112	S.EXE	88
PID 5112 wrote to memory of 1836	5112	S.EXE	88

C:\Users\Admin\AppData\Local\Temp\160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe
"C:\Users\Admin\AppData\Local\Temp\160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\S.EXE
  "C:\Users\Admin\AppData\Local\Temp\S.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1836
- C:\Users\Admin\AppData\Local\Temp\V.EXE
  "C:\Users\Admin\AppData\Local\Temp\V.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S.EXE

Path C:\Users\Admin\AppData\Local\Temp\S.EXE
Size 221KB
SHA256 872904de3861315d1327308235f0db1dcd8dc23de27d8127d57baadd13138d27
MD5 dadc63f1091f6e22549b8c881c34cd3c
SHA1 38375ae55ca88435a15d0ebbed2e3cfa911591de
SHA512 2db2f1681e3c1fa96b6581d283c49f48b799bf36567998d9fc656285847afef4205f7a48d5c780f34f3cea41477dc3ef914f11c6c2a83354f23ab6e8c07b47f5
SSDEEP 6144:29eHRIiOExNv1mwyB3a1mwyB3s8GbFbwKil6Wz4YsnwKQNi7D:29wRIifNv1mwyB3a1mwyB3s8owFLz4Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

V.EXE

Path C:\Users\Admin\AppData\Local\Temp\V.EXE
Size 218KB
SHA256 cb5a46276469443e851d43d7aa79355ca7127253521c83b34c8fb8889fb09c05
MD5 c57dcb7c0b134e5f17ebc434b7f16666
SHA1 8f984edb1286cd103763cc6e8e49c5e651ba6de8
SHA512 ddc6a626bcf58a076eefd25a28baa5dc6f04d04ed0c7c599df7a116832cc1e42c98a3254f8e47fc61f5454c4e4c0f1293fd4a7cb186e309f457fb02f4b12c758
SSDEEP 6144:30WXvXt1qz89tVaZ5x+AMJf3bTeAMmmLPGU:30gv919ymJf3XbMmmLPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1300-0-0x0000000000D80000-0x0000000000E02000-memory.dmp

Download

memory/1300-16-0x0000000000D80000-0x0000000000E02000-memory.dmp

Download

memory/1836-39-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Download

memory/1836-26-0x0000000000800000-0x0000000000828000-memory.dmp

Download

memory/1836-32-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Download

memory/1932-19-0x0000000000415000-0x0000000000416000-memory.dmp

Download

memory/4204-21-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4204-33-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/4204-34-0x00000000063C0000-0x00000000069D8000-memory.dmp

Download

memory/4204-35-0x0000000007D40000-0x0000000007E4A000-memory.dmp

Download

memory/4204-36-0x0000000006320000-0x0000000006332000-memory.dmp

Download

memory/4204-37-0x0000000005DB0000-0x0000000005DEC000-memory.dmp

Download

memory/4204-38-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

Download

memory/4204-40-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/5112-31-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/5112-20-0x0000000000400000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads