redline | b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 06:46

Target

375e9acde29beee941aa2706285f34b1.exe
Size

4.5MB
MD5

375e9acde29beee941aa2706285f34b1
SHA1

e4beb794991712982a6ef02fb41b59b7eb82b202
SHA256

b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b
SHA512

4d376813cb1ede9ad20cac49a8ad8bc83dfaefd13e1326f7710fa357e9c636446c19684641ecf16eaf0e73283895a3fe7fd29fdb12c1f60065d7c9810d256597
SSDEEP

98304:ZWFsTuRN2zazBLlLvOc1Pgd1Ea0fzsFvOFLyf:ZWFsTuRN2zahf1Y7Efy

Score

10^/10

Family

redline

Botnet

5.161.190.139:8732

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3052-6-0x0000000000080000-0x00000000000D0000-memory.dmp	family_redline
behavioral1/memory/3052-8-0x0000000000080000-0x00000000000D0000-memory.dmp	family_redline
behavioral1/memory/3052-10-0x0000000000080000-0x00000000000D0000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

375e9acde29beee941aa2706285f34b1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\kooo = "C:\\Users\\Admin\\Documents\\OTOTOTOT\\TITUIFO.exe"	375e9acde29beee941aa2706285f34b1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

375e9acde29beee941aa2706285f34b1.exe

description pid process target process

PID 1660 set thread context of 3052 1660 375e9acde29beee941aa2706285f34b1.exe csc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

csc.exe

pid process

3052 csc.exe
3052 csc.exe
3052 csc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 3052 csc.exe

description	pid	process	target process
PID 1660 set thread context of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe

description	pid	process
Token: SeDebugPrivilege	3052	csc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

375e9acde29beee941aa2706285f34b1.exe

description	pid	process	target process
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 1660 wrote to memory of 3052	1660	375e9acde29beee941aa2706285f34b1.exe	csc.exe

memory/1660-1-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/1660-0-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1660-2-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/1660-11-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/3052-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-3-0x0000000000080000-0x00000000000D0000-memory.dmp

Filesize
320KB

Download
memory/3052-6-0x0000000000080000-0x00000000000D0000-memory.dmp

Filesize
320KB

Download
memory/3052-8-0x0000000000080000-0x00000000000D0000-memory.dmp

Filesize
320KB

Download
memory/3052-10-0x0000000000080000-0x00000000000D0000-memory.dmp

Filesize
320KB

Download
memory/3052-12-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/3052-13-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/3052-14-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download