redline | 0d5bfc0c20d8142640a572b53e611015b225c0312faac51006c299e59a061a8a

General

Target

Traves Dreams.exe
Size

825KB
MD5

26e694fab0a2f2041b191cd154d85ba5
SHA1

1b36528c4f505df852d7fcdd6054cc4ab7d70024
SHA256

0d5bfc0c20d8142640a572b53e611015b225c0312faac51006c299e59a061a8a
SHA512

fd223adbf3172b4f08952f9c095456efea836cba1b869819e31fafc1819a718193f568cb3915fa69477cd45bd2ca19b30b576632d9dc91ec12b98d6e57e634c8

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1480-7-0x00000000004204BA-mapping.dmp	family_redline
behavioral1/memory/1480-6-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1480-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1480-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

868 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 checkip.amazonaws.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Traves Dreams.exe

description pid process target process

PID 764 set thread context of 1480 764 Traves Dreams.exe Traves Dreams.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

612 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Traves Dreams.exeTraves Dreams.exe

pid process

764 Traves Dreams.exe
764 Traves Dreams.exe
764 Traves Dreams.exe
764 Traves Dreams.exe
1480 Traves Dreams.exe
1480 Traves Dreams.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Traves Dreams.exeTraves Dreams.exe

description pid process

Token: SeDebugPrivilege 764 Traves Dreams.exe
Token: SeDebugPrivilege 1480 Traves Dreams.exe

pid	process
868	cmd.exe

flow	ioc
7	checkip.amazonaws.com

description	pid	process	target process
PID 764 set thread context of 1480	764	Traves Dreams.exe	Traves Dreams.exe

pid	process
612	PING.EXE

pid	process
764	Traves Dreams.exe
764	Traves Dreams.exe
764	Traves Dreams.exe
764	Traves Dreams.exe
1480	Traves Dreams.exe
1480	Traves Dreams.exe

description	pid	process
Token: SeDebugPrivilege	764	Traves Dreams.exe
Token: SeDebugPrivilege	1480	Traves Dreams.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Traves Dreams.exeTraves Dreams.execmd.exe

description	pid	process	target process
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1484	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 764 wrote to memory of 1480	764	Traves Dreams.exe	Traves Dreams.exe
PID 1480 wrote to memory of 868	1480	Traves Dreams.exe	cmd.exe
PID 1480 wrote to memory of 868	1480	Traves Dreams.exe	cmd.exe
PID 1480 wrote to memory of 868	1480	Traves Dreams.exe	cmd.exe
PID 1480 wrote to memory of 868	1480	Traves Dreams.exe	cmd.exe
PID 868 wrote to memory of 612	868	cmd.exe	PING.EXE
PID 868 wrote to memory of 612	868	cmd.exe	PING.EXE
PID 868 wrote to memory of 612	868	cmd.exe	PING.EXE
PID 868 wrote to memory of 612	868	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
2⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
4⤵
- Runs ping.exe
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-14-0x0000000000000000-mapping.dmp

Download
memory/764-0-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/764-1-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/764-3-0x0000000002150000-0x00000000021D5000-memory.dmp

Filesize
532KB

Download
memory/764-4-0x0000000000980000-0x00000000009C1000-memory.dmp

Filesize
260KB

Download
memory/764-5-0x0000000000510000-0x0000000000526000-memory.dmp

Filesize
88KB

Download
memory/868-13-0x0000000000000000-mapping.dmp

Download
memory/1480-7-0x00000000004204BA-mapping.dmp

Download
memory/1480-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1480-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1480-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1480-10-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing