redline | b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

375e9acde29beee941aa2706285f34b1.exe
Size

4.5MB
MD5

375e9acde29beee941aa2706285f34b1
SHA1

e4beb794991712982a6ef02fb41b59b7eb82b202
SHA256

b2a4a9e9cd0fbce0d8bb0e6d7bd34aacca346ad20e0835064366a557bba2e20b
SHA512

4d376813cb1ede9ad20cac49a8ad8bc83dfaefd13e1326f7710fa357e9c636446c19684641ecf16eaf0e73283895a3fe7fd29fdb12c1f60065d7c9810d256597
SSDEEP

98304:ZWFsTuRN2zazBLlLvOc1Pgd1Ea0fzsFvOFLyf:ZWFsTuRN2zahf1Y7Efy

Score

10^/10

redline x infostealer persistence spyware

Malware Config

Extracted

Family

redline

Botnet

5.161.190.139:8732

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4800-3-0x0000000000A00000-0x0000000000A50000-memory.dmp family_redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

resource	yara_rule
behavioral2/memory/4800-3-0x0000000000A00000-0x0000000000A50000-memory.dmp	family_redline

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

375e9acde29beee941aa2706285f34b1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kooo = "C:\\Users\\Admin\\Documents\\OTOTOTOT\\TITUIFO.exe"	375e9acde29beee941aa2706285f34b1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

375e9acde29beee941aa2706285f34b1.exe

description pid process target process

PID 2216 set thread context of 4800 2216 375e9acde29beee941aa2706285f34b1.exe csc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

csc.exe

pid process

4800 csc.exe
4800 csc.exe
4800 csc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csc.exe

description pid process

Token: SeDebugPrivilege 4800 csc.exe

description	pid	process	target process
PID 2216 set thread context of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe

pid	process
4800	csc.exe
4800	csc.exe
4800	csc.exe

description	pid	process
Token: SeDebugPrivilege	4800	csc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

375e9acde29beee941aa2706285f34b1.exe

description	pid	process	target process
PID 2216 wrote to memory of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 2216 wrote to memory of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 2216 wrote to memory of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 2216 wrote to memory of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe
PID 2216 wrote to memory of 4800	2216	375e9acde29beee941aa2706285f34b1.exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\375e9acde29beee941aa2706285f34b1.exe
"C:\Users\Admin\AppData\Local\Temp\375e9acde29beee941aa2706285f34b1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-4-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2216-2-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2216-1-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/2216-0-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4800-10-0x0000000006810000-0x0000000006E28000-memory.dmp

Filesize
6.1MB

Download
memory/4800-11-0x0000000005A00000-0x0000000005B0A000-memory.dmp

Filesize
1.0MB

Download
memory/4800-6-0x0000000005C40000-0x00000000061E4000-memory.dmp

Filesize
5.6MB

Download
memory/4800-7-0x0000000005690000-0x0000000005722000-memory.dmp

Filesize
584KB

Download
memory/4800-8-0x0000000005850000-0x000000000585A000-memory.dmp

Filesize
40KB

Download
memory/4800-9-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/4800-3-0x0000000000A00000-0x0000000000A50000-memory.dmp

Filesize
320KB

Download
memory/4800-5-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/4800-12-0x0000000005930000-0x0000000005942000-memory.dmp

Filesize
72KB

Download
memory/4800-13-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/4800-14-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/4800-15-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/4800-16-0x0000000008280000-0x00000000082D0000-memory.dmp

Filesize
320KB

Download
memory/4800-17-0x00000000078A0000-0x0000000007A62000-memory.dmp

Filesize
1.8MB

Download
memory/4800-18-0x0000000008800000-0x0000000008D2C000-memory.dmp

Filesize
5.2MB

Download
memory/4800-20-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download