redline | 61afa5c0da0fb5b87aa1dc81df5153152a1321d9daf6eb7e220299cf483f453c

General

Target

88f3149589f79c88dba9a8710c59f8bf.exe
Size

317KB
MD5

88f3149589f79c88dba9a8710c59f8bf
SHA1

97dcefb3f0b8d74b054894a514e344a3920c1f31
SHA256

61afa5c0da0fb5b87aa1dc81df5153152a1321d9daf6eb7e220299cf483f453c
SHA512

5e51cf28e030acaa0d9025c2298d6f6706aefcc301af76a4d5782ff253c173824592de4c8a9a66d16589214d88a800d0b7d5f601d75fbfa0c1d8af0c1cf30098

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

88f3149589f79c88dba9a8710c59f8bf.exe

pid process

3116 88f3149589f79c88dba9a8710c59f8bf.exe
3116 88f3149589f79c88dba9a8710c59f8bf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

88f3149589f79c88dba9a8710c59f8bf.exe

description pid process

Token: SeDebugPrivilege 3116 88f3149589f79c88dba9a8710c59f8bf.exe

pid	process
3116	88f3149589f79c88dba9a8710c59f8bf.exe
3116	88f3149589f79c88dba9a8710c59f8bf.exe

description	pid	process
Token: SeDebugPrivilege	3116	88f3149589f79c88dba9a8710c59f8bf.exe

C:\Users\Admin\AppData\Local\Temp\88f3149589f79c88dba9a8710c59f8bf.exe
"C:\Users\Admin\AppData\Local\Temp\88f3149589f79c88dba9a8710c59f8bf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-2-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/3116-3-0x0000000002D60000-0x0000000002D95000-memory.dmp

Filesize
212KB

Download
memory/3116-4-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/3116-5-0x0000000073660000-0x0000000073D4E000-memory.dmp

Filesize
6.9MB

Download
memory/3116-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3116-7-0x0000000003200000-0x000000000322A000-memory.dmp

Filesize
168KB

Download
memory/3116-9-0x0000000007492000-0x0000000007493000-memory.dmp

Filesize
4KB

Download
memory/3116-8-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/3116-10-0x00000000074A0000-0x00000000074A1000-memory.dmp

Filesize
4KB

Download
memory/3116-11-0x0000000004B80000-0x0000000004BA8000-memory.dmp

Filesize
160KB

Download
memory/3116-12-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/3116-13-0x0000000007493000-0x0000000007494000-memory.dmp

Filesize
4KB

Download
memory/3116-14-0x0000000007494000-0x0000000007496000-memory.dmp

Filesize
8KB

Download
memory/3116-15-0x0000000007470000-0x0000000007471000-memory.dmp

Filesize
4KB

Download
memory/3116-16-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

Filesize
4KB

Download
memory/3116-17-0x0000000008620000-0x0000000008621000-memory.dmp

Filesize
4KB

Download
memory/3116-18-0x0000000008640000-0x0000000008641000-memory.dmp

Filesize
4KB

Download
memory/3116-19-0x00000000087B0000-0x00000000087B1000-memory.dmp

Filesize
4KB

Download
memory/3116-20-0x0000000008930000-0x0000000008931000-memory.dmp

Filesize
4KB

Download
memory/3116-21-0x0000000009140000-0x0000000009141000-memory.dmp

Filesize
4KB

Download
memory/3116-22-0x0000000009320000-0x0000000009321000-memory.dmp

Filesize
4KB

Download
memory/3116-23-0x0000000009960000-0x0000000009961000-memory.dmp

Filesize
4KB

Download
memory/3116-24-0x0000000009A10000-0x0000000009A11000-memory.dmp

Filesize
4KB

Download
memory/3116-25-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/3116-26-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing