redline | e99ab798099b3c352427b7808b0a2c7e73854aaeb34001f17852e288af321f6c

General

Target

e9f2ded2b4be33b68f4d84e93df358bd.exe
Size

241KB
MD5

e9f2ded2b4be33b68f4d84e93df358bd
SHA1

a8f8dce913a1ea9c34d6325b9cc855a6d94e4d10
SHA256

e99ab798099b3c352427b7808b0a2c7e73854aaeb34001f17852e288af321f6c
SHA512

6b228430c543064062a40fd89a7cff6864394a49dc62d37ab5e67a2d8f44d4253377be695b786e60e771b7fb5c19fb867a7c942b664a8effbd985ef01652ddf8

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/972-7-0x0000000004A70000-0x0000000004A9C000-memory.dmp	family_redline
behavioral2/memory/972-11-0x0000000004C30000-0x0000000004C5A000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e9f2ded2b4be33b68f4d84e93df358bd.exe

pid process

972 e9f2ded2b4be33b68f4d84e93df358bd.exe
972 e9f2ded2b4be33b68f4d84e93df358bd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e9f2ded2b4be33b68f4d84e93df358bd.exe

description pid process

Token: SeDebugPrivilege 972 e9f2ded2b4be33b68f4d84e93df358bd.exe

pid	process
972	e9f2ded2b4be33b68f4d84e93df358bd.exe
972	e9f2ded2b4be33b68f4d84e93df358bd.exe

description	pid	process
Token: SeDebugPrivilege	972	e9f2ded2b4be33b68f4d84e93df358bd.exe

C:\Users\Admin\AppData\Local\Temp\e9f2ded2b4be33b68f4d84e93df358bd.exe
"C:\Users\Admin\AppData\Local\Temp\e9f2ded2b4be33b68f4d84e93df358bd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-2-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/972-3-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/972-4-0x0000000002D10000-0x0000000002D46000-memory.dmp

Filesize
216KB

Download
memory/972-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/972-6-0x0000000073850000-0x0000000073F3E000-memory.dmp

Filesize
6.9MB

Download
memory/972-7-0x0000000004A70000-0x0000000004A9C000-memory.dmp

Filesize
176KB

Download
memory/972-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/972-9-0x0000000004CA2000-0x0000000004CA3000-memory.dmp

Filesize
4KB

Download
memory/972-10-0x00000000073F0000-0x00000000073F1000-memory.dmp

Filesize
4KB

Download
memory/972-11-0x0000000004C30000-0x0000000004C5A000-memory.dmp

Filesize
168KB

Download
memory/972-12-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/972-13-0x0000000004CA3000-0x0000000004CA4000-memory.dmp

Filesize
4KB

Download
memory/972-14-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/972-15-0x00000000078F0000-0x00000000078F1000-memory.dmp

Filesize
4KB

Download
memory/972-16-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/972-17-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/972-18-0x0000000004CA4000-0x0000000004CA6000-memory.dmp

Filesize
8KB

Download
memory/972-19-0x0000000008100000-0x0000000008101000-memory.dmp

Filesize
4KB

Download
memory/972-20-0x0000000008280000-0x0000000008281000-memory.dmp

Filesize
4KB

Download
memory/972-21-0x0000000008E40000-0x0000000008E41000-memory.dmp

Filesize
4KB

Download
memory/972-22-0x0000000009030000-0x0000000009031000-memory.dmp

Filesize
4KB

Download
memory/972-23-0x0000000009670000-0x0000000009671000-memory.dmp

Filesize
4KB

Download
memory/972-24-0x0000000009720000-0x0000000009721000-memory.dmp

Filesize
4KB

Download
memory/972-25-0x0000000009FC0000-0x0000000009FC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing