redline | 40fb046cd3a136a4c55338295b05b887ea1de0ed7b7ae58fc0d3dc83ae54cba1

General

Target

Builder WorldWind Pro.zip
Size

1.2MB
MD5

1a13f22219851b49296ede39fcc1f65c
SHA1

353bd26f2da850e5cd596ef58e3dc96dce5bd85b
SHA256

40fb046cd3a136a4c55338295b05b887ea1de0ed7b7ae58fc0d3dc83ae54cba1
SHA512

31c587b2da90256086a740a1cf3373f64a831ede833c3393b0e6656dc467aab1c7cadf0e96c74f18bc383e41dbb985117dfc92afb5ce26a4abfcb79394366e23
SSDEEP

24576:yBPkCkNVx9Ef4cQ+KG7SKaZ5g3hYiaThGKvIkrlb4yBpssssssss0P0uxRwlL93:okNVx9QVQWOKT3/a1wkrlb10PVxSv3

Score

10^/10

redline discovery infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/1072-19-0x0000000000B20000-0x0000000000B76000-memory.dmp	family_redline
behavioral1/memory/3124-29-0x0000000001400000-0x0000000001456000-memory.dmp	family_redline
behavioral1/memory/4636-34-0x00000000008C0000-0x0000000000916000-memory.dmp	family_redline

Redline family
redline

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	224	Process not Found

Executes dropped EXE 3 IoCs

pid	Process
1072	Builder WorldWind Pro.exe
3124	Builder WorldWind Pro.exe
4636	Builder WorldWind Pro.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder WorldWind Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder WorldWind Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder WorldWind Pro.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4856	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5084	7zG.exe
Token: 35	5084	7zG.exe
Token: SeSecurityPrivilege	5084	7zG.exe
Token: SeSecurityPrivilege	5084	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5084	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Builder WorldWind Pro.zip"
1⤵
PID:696

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjFCNTk5MjEtOEIwMi00OTdBLUIzQkEtODg1Nzk3QTE2REU3fSIgdXNlcmlkPSJ7QUQzNkNDRUYtREZDQS00NTIwLTlEREEtMDcyNjc2NDUyOEU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTNDMTYwODgtOUE1Mi00N0Y4LUJGNzctNzJEOEMzMDM5MERDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczOTI5NDgzNCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNzY2NTUyNTM3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3NTMxNzc4MzEiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4644

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Builder WorldWind Pro\" -spe -an -ai#7zMap3212:100:7zEvent31496
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5084

C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe
"C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072

C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe
"C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124

C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe
"C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Builder WorldWind Pro\Builder WorldWind Pro.exe

Filesize
506KB

MD5
e5fb57e8214483fd395bd431cb3d1c4b

SHA1
60e22fc9e0068c8156462f003760efdcac82766b

SHA256
e389fc5782f754918a10b020adcd8faa11c25658b8d6f8cbc49f9ac3a7637684

SHA512
dc2ed0421db7dd5a3afeacb6a9f5017c97fc07d0b2d1745b50ede50087a58245d31d6669077a672b32541dbfa233ef87260a37be48de3bd407d8c587fc903d89

Download Submit
memory/1072-19-0x0000000000B20000-0x0000000000B76000-memory.dmp

Filesize
344KB

Download
memory/1072-23-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/1072-24-0x00000000051E0000-0x00000000051F2000-memory.dmp

Filesize
72KB

Download
memory/1072-25-0x0000000005310000-0x000000000541A000-memory.dmp

Filesize
1.0MB

Download
memory/1072-26-0x0000000005240000-0x000000000527C000-memory.dmp

Filesize
240KB

Download
memory/1072-27-0x00000000052A0000-0x00000000052EC000-memory.dmp

Filesize
304KB

Download
memory/3124-29-0x0000000001400000-0x0000000001456000-memory.dmp

Filesize
344KB

Download
memory/4636-34-0x00000000008C0000-0x0000000000916000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing