redline | 1d8ce7804176be5a0ba3c1e8c24902b1403925a5827d1efd2ca56d2298f6d910

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpiderMan MilesMorales.exe
Size

704.9MB
MD5

562dc806073ff84ced8fd82fe1aa8976
SHA1

b888889fad462bd33a24f6a672c1d8188e508148
SHA256

1cf4d4c227f2c3d58dd0b64637893dfc74fa831f0381fc23bdbbe6cd41ed447c
SHA512

33854ffe65f6abb423234898582e704ae221a81f77c17a9fdcd3a391313ff2d80d1b1679a2ea8cdb3311c5b3c75d85a7658df8e5fd1cbe40238826f696a0462b
SSDEEP

6144:sv4bgdNLhi4b5YSkBGpGVu64wdnKviGTFiiXTbv556VZYRyjmlBqpeMLDg/hcZBg:9bgdNLhi+ya3cnKvbpp3lYICaQ

Score

10^/10

redline @maksimus33 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

@Maksimus33

193.106.191.160:8673

Attributes

auth_value
3c05a8664d756c04ba672065496ef669

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3348-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Redline family
redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 3348	4760	SpiderMan MilesMorales.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	SpiderMan MilesMorales.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90
PID 4760 wrote to memory of 3348	4760	SpiderMan MilesMorales.exe	90

C:\Users\Admin\AppData\Local\Temp\SpiderMan MilesMorales.exe
"C:\Users\Admin\AppData\Local\Temp\SpiderMan MilesMorales.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-10-0x0000000004A10000-0x0000000004A22000-memory.dmp

Filesize
72KB

Download
memory/3348-11-0x0000000004A80000-0x0000000004ABC000-memory.dmp

Filesize
240KB

Download
memory/3348-15-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/3348-14-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

Filesize
4KB

Download
memory/3348-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-13-0x0000000004BF0000-0x0000000004C3C000-memory.dmp

Filesize
304KB

Download
memory/3348-12-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/3348-9-0x0000000004AE0000-0x0000000004BEA000-memory.dmp

Filesize
1.0MB

Download
memory/3348-7-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

Filesize
4KB

Download
memory/3348-8-0x0000000004F80000-0x0000000005598000-memory.dmp

Filesize
6.1MB

Download
memory/4760-0-0x00007FFD8E223000-0x00007FFD8E225000-memory.dmp

Filesize
8KB

Download
memory/4760-1-0x0000022555560000-0x00000225555C8000-memory.dmp

Filesize
416KB

Download
memory/4760-6-0x00007FFD8E220000-0x00007FFD8ECE1000-memory.dmp

Filesize
10.8MB

Download
memory/4760-3-0x00007FFD8E220000-0x00007FFD8ECE1000-memory.dmp

Filesize
10.8MB

Download
memory/4760-2-0x00000225019D0000-0x0000022501A36000-memory.dmp

Filesize
408KB

Download