redline | 0d5bfc0c20d8142640a572b53e611015b225c0312faac51006c299e59a061a8a

General

Target

Traves Dreams.exe
Size

825KB
MD5

26e694fab0a2f2041b191cd154d85ba5
SHA1

1b36528c4f505df852d7fcdd6054cc4ab7d70024
SHA256

0d5bfc0c20d8142640a572b53e611015b225c0312faac51006c299e59a061a8a
SHA512

fd223adbf3172b4f08952f9c095456efea836cba1b869819e31fafc1819a718193f568cb3915fa69477cd45bd2ca19b30b576632d9dc91ec12b98d6e57e634c8

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1504-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/1504-10-0x00000000004204BA-mapping.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 checkip.amazonaws.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Traves Dreams.exe

description pid process target process

PID 428 set thread context of 1504 428 Traves Dreams.exe Traves Dreams.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3888 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Traves Dreams.exeTraves Dreams.exe

pid process

428 Traves Dreams.exe
428 Traves Dreams.exe
428 Traves Dreams.exe
428 Traves Dreams.exe
1504 Traves Dreams.exe
1504 Traves Dreams.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Traves Dreams.exeTraves Dreams.exe

description pid process

Token: SeDebugPrivilege 428 Traves Dreams.exe
Token: SeDebugPrivilege 1504 Traves Dreams.exe

flow	ioc
15	checkip.amazonaws.com

description	pid	process	target process
PID 428 set thread context of 1504	428	Traves Dreams.exe	Traves Dreams.exe

pid	process
3888	PING.EXE

pid	process
428	Traves Dreams.exe
428	Traves Dreams.exe
428	Traves Dreams.exe
428	Traves Dreams.exe
1504	Traves Dreams.exe
1504	Traves Dreams.exe

description	pid	process
Token: SeDebugPrivilege	428	Traves Dreams.exe
Token: SeDebugPrivilege	1504	Traves Dreams.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Traves Dreams.exeTraves Dreams.execmd.exe

description	pid	process	target process
PID 428 wrote to memory of 3808	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 3808	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 3808	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 428 wrote to memory of 1504	428	Traves Dreams.exe	Traves Dreams.exe
PID 1504 wrote to memory of 812	1504	Traves Dreams.exe	cmd.exe
PID 1504 wrote to memory of 812	1504	Traves Dreams.exe	cmd.exe
PID 1504 wrote to memory of 812	1504	Traves Dreams.exe	cmd.exe
PID 812 wrote to memory of 3888	812	cmd.exe	PING.EXE
PID 812 wrote to memory of 3888	812	cmd.exe	PING.EXE
PID 812 wrote to memory of 3888	812	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
2⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe
"C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\Traves Dreams.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
4⤵
- Runs ping.exe
PID:3888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Traves Dreams.exe.log

MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
memory/428-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/428-3-0x0000000005A30000-0x0000000005A31000-memory.dmp

Filesize
4KB

Download
memory/428-4-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/428-5-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/428-6-0x0000000007100000-0x0000000007185000-memory.dmp

Filesize
532KB

Download
memory/428-7-0x00000000057E0000-0x0000000005821000-memory.dmp

Filesize
260KB

Download
memory/428-8-0x0000000005A10000-0x0000000005A26000-memory.dmp

Filesize
88KB

Download
memory/428-0-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/812-29-0x0000000000000000-mapping.dmp

Download
memory/1504-15-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/1504-20-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1504-10-0x00000000004204BA-mapping.dmp

Download
memory/1504-16-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1504-17-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/1504-18-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/1504-19-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/1504-12-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/1504-21-0x0000000006990000-0x0000000006991000-memory.dmp

Filesize
4KB

Download
memory/1504-24-0x0000000006580000-0x0000000006581000-memory.dmp

Filesize
4KB

Download
memory/1504-25-0x0000000006500000-0x0000000006501000-memory.dmp

Filesize
4KB

Download
memory/1504-26-0x00000000068C0000-0x00000000068C1000-memory.dmp

Filesize
4KB

Download
memory/1504-27-0x0000000006F30000-0x0000000006F31000-memory.dmp

Filesize
4KB

Download
memory/1504-28-0x0000000008370000-0x0000000008371000-memory.dmp

Filesize
4KB

Download
memory/1504-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3888-30-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing