redline | 26cb0502561e27e0009406c727aabaf50e476fc570baa995b6d2582d84ef8931

General

Target

JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
Size

5.0MB
MD5

f1a639dcfdd0f5637f5666802ee379e3
SHA1

025bc9f4f4c27df34adc1e99e4aad668d93008c4
SHA256

26cb0502561e27e0009406c727aabaf50e476fc570baa995b6d2582d84ef8931
SHA512

aa72d783099bf160bd6af18106ebe24625491e7a90f94dcfe0b690d10210c3e7fd9eacbed5ff34302191b38d5273568ad1d19d124c784cefa213ba873cfaa684
SSDEEP

98304:JigoF29Se5bo/R5v9jQE2dftU0C4XzNaKhC9agopRyWb:QVeSObo/zFQdU0DzjGIpRyO

Score

10^/10

redline @turbo_install discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

@turbo_install

C2

138.124.186.121:45760

Attributes

auth_value
9b509f3ca2ec2a739920d789362e5ac4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4740-30-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe

Executes dropped EXE 2 IoCs

pid	Process
3416	clean.exe
2860	tb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 4740	2860	tb.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	2860	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2860	tb.exe
2860	tb.exe
2860	tb.exe
2860	tb.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3416	4412	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	83
PID 4412 wrote to memory of 3416	4412	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	83
PID 4412 wrote to memory of 2860	4412	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	86
PID 4412 wrote to memory of 2860	4412	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	86
PID 4412 wrote to memory of 2860	4412	JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe	86
PID 2860 wrote to memory of 4740	2860	tb.exe	88
PID 2860 wrote to memory of 4740	2860	tb.exe	88
PID 2860 wrote to memory of 4740	2860	tb.exe	88
PID 2860 wrote to memory of 4740	2860	tb.exe	88
PID 2860 wrote to memory of 4740	2860	tb.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1a639dcfdd0f5637f5666802ee379e3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Roaming\clean.exe
  "C:\Users\Admin\AppData\Roaming\clean.exe"
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Users\Admin\AppData\Roaming\tb.exe
  "C:\Users\Admin\AppData\Roaming\tb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 272
    3⤵
    - Program crash
    PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2860 -ip 2860
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\clean.exe

Filesize
3.1MB

MD5
5875725554397137b21e171f7b9d5cc0

SHA1
326f43e9bfdcfa8b3bd407f51922f215a215279d

SHA256
f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc

SHA512
40addec61a0bee722fbcb3c7060ade061571b702471d8783782fd2176769c26d52ebcc600ab1fda2c26a4a470c4d2e95b31a7f36e7f9124b3e22a3e27e18b76a

Download Submit
C:\Users\Admin\AppData\Roaming\tb.exe

Filesize
4.6MB

MD5
7d2b55d6cef3542b4f9c2c9aed38b8d7

SHA1
9afbebe0466a87650d88f51dd2d8afaeb21f0864

SHA256
ae0459e96c5d0ee75988fb87960a3a59a2e61fb62c787a4746894826f1cacc32

SHA512
6dd56dcfc6a286a4a4d5975cd1ac15c213fe243b82d8c6e0c566f5818a0b5a3d1b9d9b5ca5773af4085f95601f5f5f0b85a98af4b5785adc4ce10413c9c522f2

Download Submit
memory/2860-35-0x0000000000080000-0x0000000000517000-memory.dmp

Filesize
4.6MB

Download
memory/2860-27-0x00000000000B5000-0x000000000032E000-memory.dmp

Filesize
2.5MB

Download
memory/2860-26-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2860-25-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2860-24-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/2860-23-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2860-22-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/2860-21-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/3416-28-0x00000000000E0000-0x000000000045C000-memory.dmp

Filesize
3.5MB

Download
memory/4740-30-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4740-36-0x000000007473E000-0x000000007473F000-memory.dmp

Filesize
4KB

Download
memory/4740-37-0x0000000005A70000-0x0000000006088000-memory.dmp

Filesize
6.1MB

Download
memory/4740-38-0x0000000003070000-0x0000000003082000-memory.dmp

Filesize
72KB

Download
memory/4740-39-0x0000000005560000-0x000000000566A000-memory.dmp

Filesize
1.0MB

Download
memory/4740-40-0x0000000005450000-0x000000000548C000-memory.dmp

Filesize
240KB

Download
memory/4740-41-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/4740-42-0x00000000030A0000-0x00000000030EC000-memory.dmp

Filesize
304KB

Download
memory/4740-43-0x000000007473E000-0x000000007473F000-memory.dmp

Filesize
4KB

Download
memory/4740-44-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing