redline | 6ddc127f290360a3355bf8810ae441c8ee1cd9d52581faff36bdc8b40463b559

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
Size

661KB
MD5

ebf299e666dd6d5e2e2bc6ceb3761665
SHA1

e4de13126c1f575f2217faf8abb6ac47b35a3172
SHA256

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c
SHA512

063323f0c3ba62dad9216556937e41f378463272feb014020578167f68bbfdc6dad399814de9b30815001268f0835b4b718ae58365566d67fe94e1a0ab7b80c6
SSDEEP

12288:GBUsFSdlab3dkVFQ9M6HvGSBvtMkMwyPTEpdjBSJlP0mhIzuEC96X7n0aeAhrim9:slFBNIFQKUvrB+k5tBSJVp4urM0aeAfE

Score

10^/10

redline vip-mtn infostealer

Malware Config

Extracted

Family

redline

Botnet

VIP-MTN

94.156.69.12:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2540-12-0x0000000000400000-0x0000000000452000-memory.dmp family_redline

resource	yara_rule
behavioral2/memory/2540-12-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process	target process
PID 4576 set thread context of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

pid	process
4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description pid process

Token: SeDebugPrivilege 4576 abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process
Token: SeDebugPrivilege	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

description	pid	process	target process
PID 4576 wrote to memory of 3904	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 3904	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 3904	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
PID 4576 wrote to memory of 2540	4576	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe	abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe

C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
"C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576

C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
"C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe"
2⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe
"C:\Users\Admin\AppData\Local\Temp\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe"
2⤵
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\abc5d7e2fe95585f2c118d1e8ed171ea82ec3c76b02353aa5acca13cab13a32c.exe.log
Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/2540-19-0x00000000081A0000-0x00000000082AA000-memory.dmp

Filesize
1.0MB

Download
memory/2540-17-0x0000000006810000-0x0000000006E28000-memory.dmp

Filesize
6.1MB

Download
memory/2540-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2540-23-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/2540-22-0x0000000008090000-0x00000000080DC000-memory.dmp

Filesize
304KB

Download
memory/2540-21-0x00000000067A0000-0x00000000067DC000-memory.dmp

Filesize
240KB

Download
memory/2540-20-0x0000000006740000-0x0000000006752000-memory.dmp

Filesize
72KB

Download
memory/2540-18-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/2540-16-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/2540-24-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4576-8-0x0000000005620000-0x00000000056C8000-memory.dmp

Filesize
672KB

Download
memory/4576-15-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4576-10-0x00000000057A0000-0x00000000057AC000-memory.dmp

Filesize
48KB

Download
memory/4576-1-0x0000000000810000-0x00000000008BC000-memory.dmp

Filesize
688KB

Download
memory/4576-9-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/4576-3-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/4576-2-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/4576-6-0x0000000006290000-0x00000000067BC000-memory.dmp

Filesize
5.2MB

Download
memory/4576-7-0x0000000005570000-0x000000000560C000-memory.dmp

Filesize
624KB

Download
memory/4576-0-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/4576-5-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4576-4-0x00000000052B0000-0x00000000052BA000-memory.dmp

Filesize
40KB

Download
memory/4576-11-0x00000000060D0000-0x0000000006164000-memory.dmp

Filesize
592KB

Download