redline | aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad

General

Target
SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe
Size 859KB
Sample201109-rnwq18cbfa
SHA256 aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad
MD5 a2a86e07879b36c569f8de2915d7375b
SHA1 0b5b4b8226c7c8e9c1d64aee8209dae60a14745c
SHA512 54bc2619c13be41bf23312da0e526386fee837bd4f5ec3293ce19e9e01ee67b0d2f02edb8567d806df034a37eca33f2b8f6e4837d63a1d9bd29fd45f66444426
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3844-5-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral2/memory/3844-6-0x000000000042A3AE-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4000 set thread context of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75

Kills process with taskkill 1 IoCs

evasion

pid	Process
2460	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3844	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	RegAsm.exe
Token: SeDebugPrivilege	2460	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 4000 wrote to memory of 3844	4000	SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe	75
PID 3844 wrote to memory of 3548	3844	RegAsm.exe	79
PID 3844 wrote to memory of 3548	3844	RegAsm.exe	79
PID 3844 wrote to memory of 3548	3844	RegAsm.exe	79
PID 3548 wrote to memory of 2460	3548	cmd.exe	81
PID 3548 wrote to memory of 2460	3548	cmd.exe	81
PID 3548 wrote to memory of 2460	3548	cmd.exe	81
PID 3548 wrote to memory of 3472	3548	cmd.exe	82
PID 3548 wrote to memory of 3472	3548	cmd.exe	82
PID 3548 wrote to memory of 3472	3548	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Barys.54078.8563.7745.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 3844 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3844
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-14-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Download

memory/3844-12-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download

memory/3844-5-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3844-7-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/3844-10-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/3844-11-0x0000000005F90000-0x0000000005F91000-memory.dmp

Download

memory/3844-15-0x0000000005C80000-0x0000000005C81000-memory.dmp

Download

memory/3844-13-0x0000000005A90000-0x0000000005A91000-memory.dmp

Download

memory/4000-0-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4000-4-0x0000000004D00000-0x0000000004DBC000-memory.dmp

Download

memory/4000-3-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/4000-2-0x0000000004DD0000-0x0000000004E8E000-memory.dmp

Download

memory/4000-1-0x0000000073890000-0x0000000073F7E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads