redline | abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
Size

661KB
MD5

ebf299e666dd6d5e2e2bc6ceb3761665
SHA1

e4de13126c1f575f2217faf8abb6ac47b35a3172
SHA256

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c
SHA512

063323f0c3ba62dad9216556937e41f378463272feb014020578167f68bbfdc6dad399814de9b30815001268f0835b4b718ae58365566d67fe94e1a0ab7b80c6
SSDEEP

12288:GBUsFSdlab3dkVFQ9M6HvGSBvtMkMwyPTEpdjBSJlP0mhIzuEC96X7n0aeAhrim9:slFBNIFQKUvrB+k5tBSJVp4urM0aeAfE

Score

10^/10

redline vip-mtn infostealer

Malware Config

Extracted

Family

redline

Botnet

VIP-MTN

94.156.69.12:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3988-12-0x0000000000400000-0x0000000000452000-memory.dmp family_redline

resource	yara_rule
behavioral2/memory/3988-12-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process	target process
PID 4744 set thread context of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

pid process

4744 abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
4744 abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description pid process

Token: SeDebugPrivilege 4744 abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

pid	process
4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process
Token: SeDebugPrivilege	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process	target process
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4744 wrote to memory of 3988	4744	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
"C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
"C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe"
2⤵
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe.log
Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/3988-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3988-23-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-22-0x00000000081D0000-0x000000000821C000-memory.dmp

Filesize
304KB

Download
memory/3988-21-0x0000000008060000-0x000000000809C000-memory.dmp

Filesize
240KB

Download
memory/3988-20-0x0000000008000000-0x0000000008012000-memory.dmp

Filesize
72KB

Download
memory/3988-19-0x00000000080C0000-0x00000000081CA000-memory.dmp

Filesize
1.0MB

Download
memory/3988-18-0x0000000006630000-0x0000000006C48000-memory.dmp

Filesize
6.1MB

Download
memory/3988-17-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-16-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-11-0x0000000005990000-0x0000000005A24000-memory.dmp

Filesize
592KB

Download
memory/4744-10-0x0000000004E50000-0x0000000004E5C000-memory.dmp

Filesize
48KB

Download
memory/4744-9-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/4744-15-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-8-0x0000000004FB0000-0x0000000005058000-memory.dmp

Filesize
672KB

Download
memory/4744-7-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Filesize
624KB

Download
memory/4744-6-0x0000000005C50000-0x000000000617C000-memory.dmp

Filesize
5.2MB

Download
memory/4744-0-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4744-4-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

Filesize
40KB

Download
memory/4744-3-0x0000000004BC0000-0x0000000004C52000-memory.dmp

Filesize
584KB

Download
memory/4744-2-0x0000000005170000-0x0000000005714000-memory.dmp

Filesize
5.6MB

Download
memory/4744-1-0x0000000000110000-0x00000000001BC000-memory.dmp

Filesize
688KB

Download