redline | 6ee08c01dcb3096b7a7d00c7bf4675735ef47eee67cf72afac860bac3483cfdf

General

Target

JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe
Size

360KB
MD5

8fb699aae1061d95f4b06fccad7c56e2
SHA1

23ead70d5146c0a9696014c45317a04a983bb586
SHA256

6ee08c01dcb3096b7a7d00c7bf4675735ef47eee67cf72afac860bac3483cfdf
SHA512

45851450faafe97ecfd0323e6714183f6c92ab734d69f1b02de57dbdb562d8d2fe80be04e1579c7ea9eea1d4e065a75e4b0bae5dd38d2dd66a34022a9d67fac4
SSDEEP

6144:0/7REDvYqgOsFFqgOqgWz9xjCHESvNcMfKuvireWyUPCUTIq3Ka:09EDvYHtmkwioKuqTIml

Score

10^/10

redline discovery infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4416-42-0x0000000000400000-0x0000000000440000-memory.dmp	family_redline
behavioral2/memory/4416-49-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Redline family
redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 4416	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	98

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe
4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3680	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	97
PID 4028 wrote to memory of 3680	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	97
PID 4028 wrote to memory of 3680	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	97
PID 4028 wrote to memory of 3680	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	97
PID 4028 wrote to memory of 4416	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	98
PID 4028 wrote to memory of 4416	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	98
PID 4028 wrote to memory of 4416	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	98
PID 4028 wrote to memory of 4416	4028	JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb699aae1061d95f4b06fccad7c56e2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-44-0x0000000075430000-0x000000007558D000-memory.dmp

Filesize
1.4MB

Download
memory/4028-3-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4028-8-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/4028-9-0x0000000075461000-0x0000000075462000-memory.dmp

Filesize
4KB

Download
memory/4028-10-0x0000000075430000-0x000000007558D000-memory.dmp

Filesize
1.4MB

Download
memory/4028-29-0x00000000777E2000-0x00000000777E3000-memory.dmp

Filesize
4KB

Download
memory/4028-30-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/4028-37-0x0000000075430000-0x000000007558D000-memory.dmp

Filesize
1.4MB

Download
memory/4028-38-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4028-2-0x00000000777E2000-0x00000000777E3000-memory.dmp

Filesize
4KB

Download
memory/4028-43-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4416-47-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/4416-52-0x0000000005740000-0x0000000005D58000-memory.dmp

Filesize
6.1MB

Download
memory/4416-46-0x00000000777E2000-0x00000000777E3000-memory.dmp

Filesize
4KB

Download
memory/4416-48-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/4416-49-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4416-50-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/4416-51-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-42-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4416-53-0x0000000005140000-0x0000000005152000-memory.dmp

Filesize
72KB

Download
memory/4416-54-0x0000000005270000-0x000000000537A000-memory.dmp

Filesize
1.0MB

Download
memory/4416-55-0x00000000051A0000-0x00000000051DC000-memory.dmp

Filesize
240KB

Download
memory/4416-56-0x00000000051F0000-0x000000000523C000-memory.dmp

Filesize
304KB

Download
memory/4416-57-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/4416-58-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing