redline | 1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f

General

Target

JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe
Size

848.4MB
MD5

958b433194ee34769ca0f41199816247
SHA1

4aefeecd0cec662f990763ea9bd725dfdd26d116
SHA256

1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f
SHA512

a9956c90d3505a5da81a82c5a58fc2e4be2ed5baaafdd74de4a712e6b5fc21eeaf60eab0ef8155d3e0b3bd0ef865fd9745c265a99e320553e629a1d01e51c58a
SSDEEP

12288:SDlEtGp/N7yKB9UyTLrY1XzBlflu2qwV6eyJGAJXhmq/8Z:4GGp/LrYdfxV6T

Score

10^/10

redline discovery infostealer

Malware Config

Extracted

Family

redline

C2

95.216.94.138:4328

Attributes

auth_value
a909e2aaecf96137978fea4f86400b9b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2752-2-0x0000000000090000-0x00000000000C0000-memory.dmp	family_redline
behavioral1/memory/2752-9-0x0000000000090000-0x00000000000C0000-memory.dmp	family_redline
behavioral1/memory/2752-8-0x0000000000090000-0x00000000000C0000-memory.dmp	family_redline

Redline family
redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	2748	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2752	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	31
PID 2748 wrote to memory of 2384	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	32
PID 2748 wrote to memory of 2384	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	32
PID 2748 wrote to memory of 2384	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	32
PID 2748 wrote to memory of 2384	2748	JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1a7167a869f1dd6d76993554473ac034a3d2fd0348f6e3af7dfb8ef4b08efc7f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 36
  2⤵
  - Program crash
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x00000000008A2000-0x00000000008A3000-memory.dmp

Filesize
4KB

Download
memory/2752-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-2-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/2752-1-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/2752-9-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/2752-8-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/2752-10-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2752-11-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2752-12-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-13-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2752-14-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing