redline | 4dfa820522a5a5bbbd36d4a95e13fb1d61a128f4b88a2c1c4aca6bc9d9afa0e5

General

Target

JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe
Size

212KB
MD5

cbd7947fba2fdb2fa1ed44f434216a06
SHA1

ac28ba8580612df9b63084297a027c4597135399
SHA256

4dfa820522a5a5bbbd36d4a95e13fb1d61a128f4b88a2c1c4aca6bc9d9afa0e5
SHA512

e8c623bc681a0342b33d5858a395fb766a1e041f55c4d8c783774032db9ebe417639a8fafef1fde5542d41dff548481eb0e928505c6b7f6488564192702cc077
SSDEEP

3072:uoN5Fb9KM4FcYLwd5aAWvOvQ3aIoWPp+aG:uob/v4FcN5arvIQKjWxU

Score

10^/10

redline @mersedesoc discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

@mersedesoc

C2

51.91.193.177:18717

Attributes

auth_value
74a8f00abc3c55d9a0655f0cea4e3580

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/2696-42-0x0000000000400000-0x000000000041F000-memory.dmp	family_redline
behavioral1/memory/2696-46-0x0000000000400000-0x000000000041F000-memory.dmp	family_redline
behavioral1/memory/2696-44-0x0000000000400000-0x000000000041F000-memory.dmp	family_redline
behavioral1/memory/2696-49-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Redline family
redline

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2696	regasm.exe
2696	regasm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30
PID 2896 wrote to memory of 2696	2896	JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cbd7947fba2fdb2fa1ed44f434216a06.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2696-49-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2696-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2696-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2896-13-0x0000000035DD7000-0x0000000035DD8000-memory.dmp

Filesize
4KB

Download
memory/2896-12-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2896-11-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2896-34-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-21-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-19-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-41-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-17-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-2-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2896-47-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-14-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-15-0x0000000035DD0000-0x0000000035E10000-memory.dmp

Filesize
256KB

Download
memory/2896-10-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing