redline | 6be4d25bd90b841fd9693a567f1983de0d1c4155a62ee066cf5f1837e75c1b06

Analysis

max time kernel
68s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R B X 9 5/Roblox Executor.exe
Size

359KB
MD5

e3106b33d419c2b1d7920d8f55e0b5c8
SHA1

3bfc3ec1727477c0df43644268d4c9ebdea00662
SHA256

cea6948d7fcd91a07f883c0216bbf0c8a71bbbd860b8752d965ff4421d2ec01f
SHA512

01113183c50a1eab161b5117b96a856ce457c3a30f9dcad949cd4e9020e72409be2a4e56fce7f523bd648daa1aed06e2a1f1c3ae0f3bfb6b0520e979986a9f50
SSDEEP

6144:afP6YNEL+sAO6gaZKKfL2GKfaVeV+mTlEIwrjef7UBgHvMW7xJpg1vLfIGfXP:af10AYaZZDi7VTlfwrjef7UBgHvMW7xi

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

185.196.9.26:6302

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral6/memory/756-9-0x0000000000400000-0x0000000000450000-memory.dmp family_redline
Loads dropped DLL 1 IoCs

Processes:

Roblox Executor.exe

pid process

3596 Roblox Executor.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

Roblox Executor.exe

description pid process target process

PID 3596 set thread context of 756 3596 Roblox Executor.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

MSBuild.exe

pid process

756 MSBuild.exe
756 MSBuild.exe
756 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 756 MSBuild.exe

resource	yara_rule
behavioral6/memory/756-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

pid	process
3596	Roblox Executor.exe

description	pid	process	target process
PID 3596 set thread context of 756	3596	Roblox Executor.exe	MSBuild.exe

pid	process
756	MSBuild.exe
756	MSBuild.exe
756	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	756	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Roblox Executor.exe

description	pid	process	target process
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe
PID 3596 wrote to memory of 756	3596	Roblox Executor.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\R B X 9 5\Roblox Executor.exe
"C:\Users\Admin\AppData\Local\Temp\R B X 9 5\Roblox Executor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll
Filesize
424KB

MD5
ec28aef5418f7157f9e826983146133c

SHA1
ce3d2ea83b283f32f9d8a162f5a6393eab5572a2

SHA256
adf0a47152697ea16658d2af4986ed1d0248c31421c548dbeb8d05d6c1beb6d9

SHA512
3755fa7d8afd9e51946c4f41ac651175ada3623355a4602666f0a338323dd72906dfdcfe9c4b5f73aeef6db5ea4d5e6d281694daf9a3f863859ce38cb4e016d7

Download Submit
memory/756-21-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/756-23-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/756-18-0x00000000065C0000-0x0000000006BD8000-memory.dmp

Filesize
6.1MB

Download
memory/756-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/756-16-0x00000000056D0000-0x00000000056DA000-memory.dmp

Filesize
40KB

Download
memory/756-28-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/756-13-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/756-14-0x00000000059F0000-0x0000000005F94000-memory.dmp

Filesize
5.6MB

Download
memory/756-19-0x00000000058B0000-0x00000000059BA000-memory.dmp

Filesize
1.0MB

Download
memory/756-17-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/756-26-0x0000000007130000-0x0000000007180000-memory.dmp

Filesize
320KB

Download
memory/756-25-0x0000000007880000-0x0000000007DAC000-memory.dmp

Filesize
5.2MB

Download
memory/756-15-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/756-20-0x00000000057C0000-0x00000000057D2000-memory.dmp

Filesize
72KB

Download
memory/756-24-0x0000000007180000-0x0000000007342000-memory.dmp

Filesize
1.8MB

Download
memory/756-22-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/3596-2-0x0000000005830000-0x0000000005836000-memory.dmp

Filesize
24KB

Download
memory/3596-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Filesize
4KB

Download
memory/3596-1-0x0000000000DA0000-0x0000000000E04000-memory.dmp

Filesize
400KB

Download
memory/3596-29-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/3596-12-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/3596-11-0x0000000077891000-0x00000000779B1000-memory.dmp

Filesize
1.1MB

Download