redline | 640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe
Size

6.3MB
MD5

b88f61a7938ef8af011259c59efc3d3d
SHA1

ba6f4356993959799fbd88bb350558045c363a85
SHA256

640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2
SHA512

ba7a3564327f2ec4e0c34710205bdb297b8c4a29f020f973462897d52f4d99fefbb74c1f511195d2ac3bae0e44a8dc749cdf6d043ff5fba9939cdd73c59e7d40
SSDEEP

98304:0rLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvd6:uhIkwt+x31/CICj1lg6

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2876-34-0x0000000000E60000-0x0000000000EAA000-memory.dmp family_redline
Executes dropped EXE 2 IoCs

Processes:

WeMod.exeSirus.exe

pid process

1312 WeMod.exe
2876 Sirus.exe

resource	yara_rule
behavioral1/memory/2876-34-0x0000000000E60000-0x0000000000EAA000-memory.dmp	family_redline

Loads dropped DLL 3 IoCs

Processes:

640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe

pid	process
1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe
1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe
1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

WeMod.exe

pid process

1312 WeMod.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WeMod.exeSirus.exe

pid	process
1312	WeMod.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe
2876	Sirus.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sirus.exe

description	pid	process
Token: SeDebugPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeBackupPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe
Token: SeSecurityPrivilege	2876	Sirus.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe

description	pid	process	target process
PID 1700 wrote to memory of 1312	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	WeMod.exe
PID 1700 wrote to memory of 1312	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	WeMod.exe
PID 1700 wrote to memory of 1312	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	WeMod.exe
PID 1700 wrote to memory of 1312	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	WeMod.exe
PID 1700 wrote to memory of 2876	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	Sirus.exe
PID 1700 wrote to memory of 2876	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	Sirus.exe
PID 1700 wrote to memory of 2876	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	Sirus.exe
PID 1700 wrote to memory of 2876	1700	640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe	Sirus.exe

C:\Users\Admin\AppData\Local\Temp\640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe
"C:\Users\Admin\AppData\Local\Temp\640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Roaming\WeMod.exe
C:\Users\Admin\AppData\Roaming\WeMod.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1312

C:\Users\Admin\AppData\Roaming\Sirus.exe
C:\Users\Admin\AppData\Roaming\Sirus.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72F6.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1312-12-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-26-0x000000013F551000-0x000000013F800000-memory.dmp

Filesize
2.7MB

Download
memory/1312-11-0x000000013F551000-0x000000013F800000-memory.dmp

Filesize
2.7MB

Download
memory/1312-14-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-15-0x00000000000D0000-0x0000000000117000-memory.dmp

Filesize
284KB

Download
memory/1312-13-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-20-0x000007FEFDB00000-0x000007FEFDB6C000-memory.dmp

Filesize
432KB

Download
memory/1312-18-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-7-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-10-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-25-0x000000013F2C0000-0x000000013F800000-memory.dmp

Filesize
5.2MB

Download
memory/1312-24-0x000007FEFF570000-0x000007FEFF60F000-memory.dmp

Filesize
636KB

Download
memory/1312-22-0x0000000077990000-0x0000000077B39000-memory.dmp

Filesize
1.7MB

Download
memory/1700-8-0x0000000002ED0000-0x0000000003410000-memory.dmp

Filesize
5.2MB

Download
memory/1700-9-0x0000000002ED0000-0x0000000003410000-memory.dmp

Filesize
5.2MB

Download
memory/2876-33-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/2876-34-0x0000000000E60000-0x0000000000EAA000-memory.dmp

Filesize
296KB

Download
memory/2876-35-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-193-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/2876-214-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download