redline | 8dc33fa00c5081233fa79e35c7de7bb9769e280f245401dbede7a7d02969b0ba

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe
Size

4.0MB
MD5

f600d5e0f9a95a876b9887dd00fc6632
SHA1

4219643d72cd0d5c4b50dcee3326a2d41e5d225e
SHA256

8dc33fa00c5081233fa79e35c7de7bb9769e280f245401dbede7a7d02969b0ba
SHA512

2bcd36d7cc4b704d5bf03221ea4b27d9c77c3f3524829570282cc19118db728decb80a0822216e8a00d93ce09ca3e553778ce7178b848aac0af11dece426e0e9
SSDEEP

98304:LW0Ep9I8UCCQ7b6rAVsq2/zYvMvLvRXiheE0gHv/zL:Ea5CCu6rA6qTvcRVZgHvLL

Score

10^/10

redline @f1gasebe discovery execution infostealer

Malware Config

Extracted

Family

redline

Botnet

@F1gaSebe

95.181.152.6:46927

Attributes

auth_value
cdf3919a262c0d6ba99116b375d7551c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/2280-12-0x0000000000360000-0x000000000038E000-memory.dmp	family_redline
behavioral1/memory/2280-19-0x0000000000360000-0x000000000038E000-memory.dmp	family_redline
behavioral1/memory/2280-21-0x0000000000520000-0x0000000000540000-memory.dmp	family_redline
behavioral1/memory/2280-26-0x0000000000360000-0x000000000038E000-memory.dmp	family_redline

Redline family
redline

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe
1672	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2684	Minsteryard.exe
2280	fYxbPKoziOFe.exe
2872	svchost.exe
2380	svchost.exe
1880	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe
1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe
1904	taskeng.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WindowsPro\svchost.exe	Minsteryard.exe
File created	C:\Windows\system32\WindowsPro\svchost.exe	Minsteryard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fYxbPKoziOFe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2684	Minsteryard.exe
1740	powershell.exe
1672	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	Minsteryard.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2872	svchost.exe
Token: SeDebugPrivilege	2380	svchost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2684	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	30
PID 1872 wrote to memory of 2684	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	30
PID 1872 wrote to memory of 2684	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	30
PID 1872 wrote to memory of 2684	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	30
PID 1872 wrote to memory of 2280	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	31
PID 1872 wrote to memory of 2280	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	31
PID 1872 wrote to memory of 2280	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	31
PID 1872 wrote to memory of 2280	1872	JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe	31
PID 2684 wrote to memory of 1644	2684	Minsteryard.exe	34
PID 2684 wrote to memory of 1644	2684	Minsteryard.exe	34
PID 2684 wrote to memory of 1644	2684	Minsteryard.exe	34
PID 2684 wrote to memory of 560	2684	Minsteryard.exe	36
PID 2684 wrote to memory of 560	2684	Minsteryard.exe	36
PID 2684 wrote to memory of 560	2684	Minsteryard.exe	36
PID 1644 wrote to memory of 1740	1644	cmd.exe	37
PID 1644 wrote to memory of 1740	1644	cmd.exe	37
PID 1644 wrote to memory of 1740	1644	cmd.exe	37
PID 1644 wrote to memory of 1672	1644	cmd.exe	39
PID 1644 wrote to memory of 1672	1644	cmd.exe	39
PID 1644 wrote to memory of 1672	1644	cmd.exe	39
PID 1904 wrote to memory of 2872	1904	taskeng.exe	41
PID 1904 wrote to memory of 2872	1904	taskeng.exe	41
PID 1904 wrote to memory of 2872	1904	taskeng.exe	41
PID 1904 wrote to memory of 2380	1904	taskeng.exe	42
PID 1904 wrote to memory of 2380	1904	taskeng.exe	42
PID 1904 wrote to memory of 2380	1904	taskeng.exe	42
PID 1904 wrote to memory of 1880	1904	taskeng.exe	43
PID 1904 wrote to memory of 1880	1904	taskeng.exe	43
PID 1904 wrote to memory of 1880	1904	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f600d5e0f9a95a876b9887dd00fc6632.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\Minsteryard.exe
  C:\Users\Admin\AppData\Local\Temp\Minsteryard.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\cmd.exe
    "cmd" #cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1672
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /f /sc minute /rl highest /mo 1 /tn "Panaesthesia" /tr "C:\Windows\system32\WindowsPro\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:560
- C:\Users\Admin\AppData\Local\Temp\fYxbPKoziOFe.exe
  C:\Users\Admin\AppData\Local\Temp\fYxbPKoziOFe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2280

C:\Windows\system32\taskeng.exe
taskeng.exe {9B5D365E-CDBE-4D37-BE67-2728DA882FA6} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\WindowsPro\svchost.exe
  C:\Windows\system32\WindowsPro\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\WindowsPro\svchost.exe
  C:\Windows\system32\WindowsPro\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\system32\WindowsPro\svchost.exe
  C:\Windows\system32\WindowsPro\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
58ebd154d8d48f093b5d2c8ad3241d65

SHA1
cec6c9296f8cafb394d86058b6e9dc43b9d45c9f

SHA256
7349b47c4a5b097e1a00dcc6083e5a589a47d30fd7c5e3e8d90354890cf4832c

SHA512
4b50e090cf93d81130eeeb9a372810c2ced808a87163b7e71a6d4341eef12a4b52ae6c7af87befbe7033b5391237db5ae49d0fe2db2600b9a9f6659e27617bb0

Download Submit
C:\Windows\System32\WindowsPro\svchost.exe

Filesize
10.6MB

MD5
e9f0328af62708ebc3195bf8bcce0e33

SHA1
895714970058e95cbd4105bea75b269283cd2f28

SHA256
38933c4147c1ed7ddfe16170f9a34ff06ccf35b0d6c17edccd73ce2790db2f26

SHA512
05e530d6e737dad716e4ae51336b486b28506fc11ddaa3f644b38fb5322517306e524144b9bf1e76280c464c91eb03932891a14d24dc25a6bcce165238286881

Download Submit
C:\Windows\System32\WindowsPro\svchost.exe

Filesize
7.4MB

MD5
8a1552d8525f9e9b8b7b6eb618235f93

SHA1
802e13438c4b28e7d96dde4adc1c9d1f6e734f49

SHA256
8bf4064c2ceba0dc9a8fa7e5e745837233d85c0087c9b977ea7d322a63edbc35

SHA512
074da90c42ca4c6343ee545ca92f59f7c0283b86f42567a30a7c557746c98fcd10a210464c7c50bdf26a0af20d3b85dc2a4d5e1b5167c9e12a98e639b32d4582

Download Submit
\Users\Admin\AppData\Local\Temp\Minsteryard.exe

Filesize
3.7MB

MD5
1ad3029c8d2a4757628b99efc75a87ef

SHA1
3a6164f653bc11c303c98716764c443fe651b6e8

SHA256
9b7b1e2944d31e405a7d72a08ecf193f509ff52e5670f6813be986ac9ff65ecc

SHA512
f097481515d99e7ddf11fbd09c004c5286e3857fb1fb2c9305a4e491611690f4cf61303654802545a9259762fc1ba18845185ac651d06cdbf83db19133cf0bbe

Download Submit
\Users\Admin\AppData\Local\Temp\fYxbPKoziOFe.exe

Filesize
839KB

MD5
9de8c7cb28923bbe39c5c668eae0f21f

SHA1
1f4d88fadb7648033c16a983376e96ce2f7b0039

SHA256
844f5a9d5b9b4a552325449601071e0ecf449b04232ec16ddffe03ae404fc8a4

SHA512
d2f310f98551207b1842d307cf17a1a175676b92cecde885d66b2b58e34da7664ca4e007a724bcb4bda35b10f4b8f0dec81bbe59f9ee3d07915c75eb37257278

Download Submit
memory/1672-51-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/1672-50-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1740-44-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/1740-38-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2280-26-0x0000000000360000-0x000000000038E000-memory.dmp

Filesize
184KB

Download
memory/2280-19-0x0000000000360000-0x000000000038E000-memory.dmp

Filesize
184KB

Download
memory/2280-12-0x0000000000360000-0x000000000038E000-memory.dmp

Filesize
184KB

Download
memory/2280-20-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download
memory/2280-27-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download
memory/2280-28-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-29-0x0000000000550000-0x0000000000628000-memory.dmp

Filesize
864KB

Download
memory/2280-21-0x0000000000520000-0x0000000000540000-memory.dmp

Filesize
128KB

Download
memory/2280-22-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-32-0x000000001E7C0000-0x000000001EA20000-memory.dmp

Filesize
2.4MB

Download
memory/2684-31-0x0000000021180000-0x00000000214A6000-memory.dmp

Filesize
3.1MB

Download
memory/2684-30-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/2684-23-0x000000001C590000-0x000000001C8C2000-memory.dmp

Filesize
3.2MB

Download
memory/2684-24-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/2684-25-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

Filesize
4KB

Download
memory/2684-11-0x0000000000B50000-0x0000000000F02000-memory.dmp

Filesize
3.7MB

Download
memory/2684-8-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

Filesize
4KB

Download
memory/2872-56-0x0000000001150000-0x0000000001502000-memory.dmp

Filesize
3.7MB

Download