redline | 5d63d1c4eb964d27d53d83b399b38ffad6609b204b8741e5626d4427cc7421af

General

Target

ae4ac666d4c6073f23e078629ee01bba.exe
Size

400KB
MD5

ae4ac666d4c6073f23e078629ee01bba
SHA1

606a6e995b3754ff1494730242cf9fdf65936740
SHA256

5d63d1c4eb964d27d53d83b399b38ffad6609b204b8741e5626d4427cc7421af
SHA512

19d566f149b780dbd37aaa1ae1d72572bfb078da9f320c6fca04d0ea85b97431263104720910972d332ca94cb2801eef323388ad6a8e76c34d85336ec13426ef

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4712-7-0x00000000027B0000-0x00000000027D8000-memory.dmp	family_redline
behavioral2/memory/4712-9-0x0000000002850000-0x0000000002876000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ae4ac666d4c6073f23e078629ee01bba.exe

pid process

4712 ae4ac666d4c6073f23e078629ee01bba.exe
4712 ae4ac666d4c6073f23e078629ee01bba.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ae4ac666d4c6073f23e078629ee01bba.exe

description pid process

Token: SeDebugPrivilege 4712 ae4ac666d4c6073f23e078629ee01bba.exe

pid	process
4712	ae4ac666d4c6073f23e078629ee01bba.exe
4712	ae4ac666d4c6073f23e078629ee01bba.exe

description	pid	process
Token: SeDebugPrivilege	4712	ae4ac666d4c6073f23e078629ee01bba.exe

C:\Users\Admin\AppData\Local\Temp\ae4ac666d4c6073f23e078629ee01bba.exe
"C:\Users\Admin\AppData\Local\Temp\ae4ac666d4c6073f23e078629ee01bba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4712-2-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/4712-3-0x0000000000860000-0x0000000000895000-memory.dmp

Filesize
212KB

Download
memory/4712-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4712-5-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/4712-6-0x0000000073400000-0x0000000073AEE000-memory.dmp

Filesize
6.9MB

Download
memory/4712-7-0x00000000027B0000-0x00000000027D8000-memory.dmp

Filesize
160KB

Download
memory/4712-8-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4712-9-0x0000000002850000-0x0000000002876000-memory.dmp

Filesize
152KB

Download
memory/4712-10-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/4712-11-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4712-12-0x0000000005112000-0x0000000005113000-memory.dmp

Filesize
4KB

Download
memory/4712-13-0x0000000005113000-0x0000000005114000-memory.dmp

Filesize
4KB

Download
memory/4712-14-0x0000000005114000-0x0000000005116000-memory.dmp

Filesize
8KB

Download
memory/4712-15-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4712-16-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/4712-17-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/4712-18-0x0000000006190000-0x0000000006191000-memory.dmp

Filesize
4KB

Download
memory/4712-19-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/4712-20-0x0000000006480000-0x0000000006481000-memory.dmp

Filesize
4KB

Download
memory/4712-21-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/4712-22-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/4712-23-0x00000000074B0000-0x00000000074B1000-memory.dmp

Filesize
4KB

Download
memory/4712-24-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/4712-25-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing