redline | 1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c

Analysis

max time kernel
199s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe
Size

360KB
MD5

5c848b7494776271f221dfae8fae6688
SHA1

e5cc8feb2df6e8a68a5b7729415765d5b20f031b
SHA256

1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c
SHA512

e61c5f4be440592f7c4db796670729c6b97a0dabd1828d82743b290793505fb013445872945a841815e2b9c4c028bb249b7972cb5e7213877bf3fd546bf29ac2
SSDEEP

6144:sF/HMdSQIW/YoAYTsArJsX3B3natajMOv+hfg7GOmMNUk1rx+Qny8SKMw3DUTG1V:sF/sdSQahArJIR31m1g7GOmMNUk1rx++

Score

10^/10

redline @cloudytteam infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3956-9-0x0000000000400000-0x0000000000450000-memory.dmp family_redline
Loads dropped DLL 1 IoCs

Processes:

1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe

pid process

2280 1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe

description pid process target process

PID 2280 set thread context of 3956 2280 1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

MSBuild.exe

pid process

3956 MSBuild.exe
3956 MSBuild.exe
3956 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3956 MSBuild.exe

resource	yara_rule
behavioral2/memory/3956-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

pid	process
2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe

description	pid	process	target process
PID 2280 set thread context of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe

pid	process
3956	MSBuild.exe
3956	MSBuild.exe
3956	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3956	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe

description	pid	process	target process
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe
PID 2280 wrote to memory of 3956	2280	1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe
"C:\Users\Admin\AppData\Local\Temp\1752459540c8e8ffc933c3457b84f46b89e3597c18d9894e87cb86a0e6a96e9c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\d3d9.dll
Filesize
424KB

MD5
b952155527c5fcfc7af1031a08289376

SHA1
215dc44c3aae0374d94ed65d81a4f13f49b1e2c1

SHA256
2b895f578bbe3beb99be07f014f2bc18bbea5b1ab21218f095528cf31774b8de

SHA512
323e4edfa7596cdf8b44c2ec112b7c8f3e252963ff3eb38d94776b4fb8e60734a6d80c6ced61a92d1af11f7715fa96c5ae7c632b76077d5aaafc157618bbb2dd

Download Submit
memory/2280-12-0x0000000075370000-0x00000000753D0000-memory.dmp

Filesize
384KB

Download
memory/2280-1-0x00000000005B0000-0x0000000000614000-memory.dmp

Filesize
400KB

Download
memory/2280-2-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/2280-0-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download
memory/2280-11-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-14-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/3956-18-0x0000000002AE0000-0x0000000002AEA000-memory.dmp

Filesize
40KB

Download
memory/3956-22-0x0000000005530000-0x000000000556E000-memory.dmp

Filesize
248KB

Download
memory/3956-15-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/3956-16-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/3956-17-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/3956-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3956-19-0x0000000006270000-0x0000000006876000-memory.dmp

Filesize
6.0MB

Download
memory/3956-20-0x00000000055B0000-0x00000000056BA000-memory.dmp

Filesize
1.0MB

Download
memory/3956-21-0x00000000054D0000-0x00000000054E2000-memory.dmp

Filesize
72KB

Download
memory/3956-13-0x0000000005760000-0x0000000005C5E000-memory.dmp

Filesize
5.0MB

Download
memory/3956-23-0x00000000056C0000-0x000000000570B000-memory.dmp

Filesize
300KB

Download
memory/3956-24-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/3956-25-0x0000000006B10000-0x0000000006B60000-memory.dmp

Filesize
320KB

Download
memory/3956-26-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/3956-27-0x0000000006E30000-0x0000000006FF2000-memory.dmp

Filesize
1.8MB

Download
memory/3956-28-0x0000000007530000-0x0000000007A5C000-memory.dmp

Filesize
5.2MB

Download
memory/3956-30-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download