redline | 6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4

General

Target

6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe
Size

261KB
MD5

7c8af162128d0bdaf8ad55c506bf7110
SHA1

6728e5a5f66685afdebac5020a7d45dd91383a29
SHA256

6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4
SHA512

c3281994e521ed1d313678bdfba9912c4b22ceea865178514af3dda7a51f90e668a80fd75bdafa648834913c5a91307154271d13f219f16595f73d8c3134d790
SSDEEP

3072:WJhg7bWY1OhGO1RyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:WvgOY1QqFaQ7W05AEezbMPZFzAy2yA

Score

10^/10

redline sheron discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/460-2-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Redline family
redline

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	4176	Process not Found

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4372 set thread context of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3548	4372	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1128	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87
PID 4372 wrote to memory of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87
PID 4372 wrote to memory of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87
PID 4372 wrote to memory of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87
PID 4372 wrote to memory of 460	4372	6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe	87

C:\Users\Admin\AppData\Local\Temp\6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe
"C:\Users\Admin\AppData\Local\Temp\6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 140
  2⤵
  - Program crash
  PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4372 -ip 4372
1⤵
PID:1840

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzhCQTIyODEtRkFDQi00RjUxLUE4M0UtQTE2NzYwMTAwMERGfSIgdXNlcmlkPSJ7RUFFQUQ0NEEtNzE4MS00M0FBLTlGN0YtNzQ3MTcwRjRFMkYxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTBCMEI5RkEtQkE4Ni00MTBDLTg0M0UtMkU3ODhBM0UyMUMwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDg1MzA2NTc4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/460-7-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/460-8-0x0000000001290000-0x0000000001296000-memory.dmp

Filesize
24KB

Download
memory/460-9-0x000000000ABF0000-0x000000000B208000-memory.dmp

Filesize
6.1MB

Download
memory/460-10-0x000000000A700000-0x000000000A80A000-memory.dmp

Filesize
1.0MB

Download
memory/460-11-0x000000000A640000-0x000000000A652000-memory.dmp

Filesize
72KB

Download
memory/460-13-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/460-12-0x000000000A6A0000-0x000000000A6DC000-memory.dmp

Filesize
240KB

Download
memory/460-14-0x0000000002B90000-0x0000000002BDC000-memory.dmp

Filesize
304KB

Download
memory/460-15-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/460-16-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/4372-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing