redline | 26cb0502561e27e0009406c727aabaf50e476fc570baa995b6d2582d84ef8931

General

Target

JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
Size

5.0MB
MD5

f1a639dcfdd0f5637f5666802ee379e3
SHA1

025bc9f4f4c27df34adc1e99e4aad668d93008c4
SHA256

26cb0502561e27e0009406c727aabaf50e476fc570baa995b6d2582d84ef8931
SHA512

aa72d783099bf160bd6af18106ebe24625491e7a90f94dcfe0b690d10210c3e7fd9eacbed5ff34302191b38d5273568ad1d19d124c784cefa213ba873cfaa684
SSDEEP

98304:JigoF29Se5bo/R5v9jQE2dftU0C4XzNaKhC9agopRyWb:QVeSObo/zFQdU0DzjGIpRyO

Score

10^/10

redline @turbo_install discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

@turbo_install

C2

138.124.186.121:45760

Attributes

auth_value
9b509f3ca2ec2a739920d789362e5ac4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/1380-68-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1380-69-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1380-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
2776	clean.exe
2664	tb.exe

Loads dropped DLL 7 IoCs

pid	Process
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
2944	Process not Found

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 1380	2664	tb.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	tb.exe
2664	tb.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2776	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	30
PID 3064 wrote to memory of 2776	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	30
PID 3064 wrote to memory of 2776	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	30
PID 3064 wrote to memory of 2776	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	30
PID 3064 wrote to memory of 2664	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	31
PID 3064 wrote to memory of 2664	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	31
PID 3064 wrote to memory of 2664	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	31
PID 3064 wrote to memory of 2664	3064	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	31
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33
PID 2664 wrote to memory of 1380	2664	tb.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Roaming\clean.exe
  "C:\Users\Admin\AppData\Roaming\clean.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Users\Admin\AppData\Roaming\tb.exe
  "C:\Users\Admin\AppData\Roaming\tb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tb.exe

Filesize
4.6MB

MD5
7d2b55d6cef3542b4f9c2c9aed38b8d7

SHA1
9afbebe0466a87650d88f51dd2d8afaeb21f0864

SHA256
ae0459e96c5d0ee75988fb87960a3a59a2e61fb62c787a4746894826f1cacc32

SHA512
6dd56dcfc6a286a4a4d5975cd1ac15c213fe243b82d8c6e0c566f5818a0b5a3d1b9d9b5ca5773af4085f95601f5f5f0b85a98af4b5785adc4ce10413c9c522f2

Download Submit
\Users\Admin\AppData\Roaming\clean.exe

Filesize
3.1MB

MD5
5875725554397137b21e171f7b9d5cc0

SHA1
326f43e9bfdcfa8b3bd407f51922f215a215279d

SHA256
f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc

SHA512
40addec61a0bee722fbcb3c7060ade061571b702471d8783782fd2176769c26d52ebcc600ab1fda2c26a4a470c4d2e95b31a7f36e7f9124b3e22a3e27e18b76a

Download Submit
memory/1380-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1380-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1380-66-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1380-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1380-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2664-39-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2664-31-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2664-46-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2664-44-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2664-41-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2664-51-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2664-36-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2664-34-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2664-32-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2664-49-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2664-29-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2664-59-0x0000000000180000-0x0000000000617000-memory.dmp

Filesize
4.6MB

Download
memory/2664-54-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2664-56-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2664-57-0x00000000001B5000-0x000000000042E000-memory.dmp

Filesize
2.5MB

Download
memory/2664-27-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2664-70-0x00000000001B5000-0x000000000042E000-memory.dmp

Filesize
2.5MB

Download
memory/2776-26-0x0000000000E90000-0x000000000120C000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing