redline | aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad

General

Target
SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe
Size 859KB
Sample201109-rnwq18cbfa
SHA256 aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad
MD5 a2a86e07879b36c569f8de2915d7375b
SHA1 0b5b4b8226c7c8e9c1d64aee8209dae60a14745c
SHA512 54bc2619c13be41bf23312da0e526386fee837bd4f5ec3293ce19e9e01ee67b0d2f02edb8567d806df034a37eca33f2b8f6e4837d63a1d9bd29fd45f66444426
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1292-5-0x000000000042A3AE-mapping.dmp	family_redline
behavioral1/memory/1292-4-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral1/memory/1292-6-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral1/memory/1292-7-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26

Kills process with taskkill 1 IoCs

evasion

pid	Process
1532	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1292	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	RegAsm.exe
Token: SeDebugPrivilege	1532	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1904 wrote to memory of 1292	1904	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	26
PID 1292 wrote to memory of 1636	1292	RegAsm.exe	31
PID 1292 wrote to memory of 1636	1292	RegAsm.exe	31
PID 1292 wrote to memory of 1636	1292	RegAsm.exe	31
PID 1292 wrote to memory of 1636	1292	RegAsm.exe	31
PID 1636 wrote to memory of 1532	1636	cmd.exe	33
PID 1636 wrote to memory of 1532	1636	cmd.exe	33
PID 1636 wrote to memory of 1532	1636	cmd.exe	33
PID 1636 wrote to memory of 1532	1636	cmd.exe	33
PID 1636 wrote to memory of 920	1636	cmd.exe	34
PID 1636 wrote to memory of 920	1636	cmd.exe	34
PID 1636 wrote to memory of 920	1636	cmd.exe	34
PID 1636 wrote to memory of 920	1636	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1292 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1292
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-4-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1292-6-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1292-7-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1292-8-0x0000000072E30000-0x000000007351E000-memory.dmp

Download

memory/1904-0-0x0000000001E30000-0x0000000001E41000-memory.dmp

Download

memory/1904-1-0x0000000073AF0000-0x00000000741DE000-memory.dmp

Download

memory/1904-2-0x00000000049F0000-0x0000000004AAE000-memory.dmp

Download

memory/1904-3-0x00000000048F0000-0x00000000049AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads