redline | edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Size

1.5MB
MD5

aa9d475bc02429a35578c7c7495391c0
SHA1

aefabfe061db6b6013e842c1ff5afb09b5686a6a
SHA256

edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91
SHA512

3b058dee4b5a959b64e1ade4206f87a4ec46594b58a270866920318593d98c9025b15d17c3486f1595955238cedde86f1b2a8ebb722cc1668c315a9fcd31560a
SSDEEP

24576:iUwjiv9SI194bspApcCmILYKV+u9O4qZFIYJnddR+Xk85PPU5cgyXd8UOybz:ROivgHcCmIf+u9YZrpk9BRdhbz

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

185.196.9.26:6302

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3824-8-0x0000000000400000-0x0000000000450000-memory.dmp family_redline
Loads dropped DLL 1 IoCs

Processes:

edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe

pid process

1816 edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe

description pid process target process

PID 1816 set thread context of 3824 1816 edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

MSBuild.exe

pid process

3824 MSBuild.exe
3824 MSBuild.exe
3824 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3824 MSBuild.exe

resource	yara_rule
behavioral2/memory/3824-8-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

pid	process
1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe

description	pid	process	target process
PID 1816 set thread context of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe

pid	process
3824	MSBuild.exe
3824	MSBuild.exe
3824	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3824	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe

description	pid	process	target process
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe
PID 1816 wrote to memory of 3824	1816	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
"C:\Users\Admin\AppData\Local\Temp\edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll
Filesize
418KB

MD5
0733702d1847b275961a140d86338cf3

SHA1
9fedbbd481efe7bf36ad9f29d498e713d20a540d

SHA256
928a5a928ce6419448fe53f3c8fae38f246fe6db7228e38e761c5113a052f55b

SHA512
48acef460899768931167c62019f06a708c8ae06cbfb714153172ce147d831e55258e5ea634b0325f898aec2161670a21f22a0aae3dbb6ac01e3b7578abc8a4f

Download Submit
memory/1816-0-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/1816-1-0x0000000000690000-0x0000000000820000-memory.dmp

Filesize
1.6MB

Download
memory/1816-27-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/1816-10-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3824-16-0x0000000006250000-0x0000000006868000-memory.dmp

Filesize
6.1MB

Download
memory/3824-18-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/3824-13-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/3824-15-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3824-14-0x0000000005280000-0x000000000528A000-memory.dmp

Filesize
40KB

Download
memory/3824-12-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3824-17-0x0000000005530000-0x000000000563A000-memory.dmp

Filesize
1.0MB

Download
memory/3824-11-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/3824-19-0x00000000053C0000-0x00000000053FC000-memory.dmp

Filesize
240KB

Download
memory/3824-20-0x0000000005410000-0x000000000545C000-memory.dmp

Filesize
304KB

Download
memory/3824-21-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/3824-22-0x0000000006BC0000-0x0000000006C10000-memory.dmp

Filesize
320KB

Download
memory/3824-23-0x0000000006EE0000-0x00000000070A2000-memory.dmp

Filesize
1.8MB

Download
memory/3824-24-0x00000000075E0000-0x0000000007B0C000-memory.dmp

Filesize
5.2MB

Download
memory/3824-26-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3824-8-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download