redline | b64b8d6ed783256668905a1347aabd325abd166ef465509e82e7c4e8c3d00166

General

Target

634d7f8408d97c81dba3963924702d77.exe
Size

573KB
MD5

634d7f8408d97c81dba3963924702d77
SHA1

35510b0a33f9d0195b7cf0fe24f1c66418766901
SHA256

b64b8d6ed783256668905a1347aabd325abd166ef465509e82e7c4e8c3d00166
SHA512

8f2c04249ea5b61c199f13e8dbc43be04088f5286fb8b9ecd7dece8cc195489f740b0a2f1c86440a98df417421f1d1daea55ed4294c92ed20cd2bd7fb7f8497e

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1528-16-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/1528-17-0x0000000000421DFE-mapping.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

updatej.exeupdatej.exe

pid process

2072 updatej.exe
1528 updatej.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

updatej.exe

description pid process target process

PID 2072 set thread context of 1528 2072 updatej.exe updatej.exe

pid	process
2072	updatej.exe
1528	updatej.exe

description	pid	process	target process
PID 2072 set thread context of 1528	2072	updatej.exe	updatej.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

634d7f8408d97c81dba3963924702d77.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	634d7f8408d97c81dba3963924702d77.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	634d7f8408d97c81dba3963924702d77.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

updatej.exe

pid process

1528 updatej.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

updatej.exe

description pid process

Token: SeDebugPrivilege 1528 updatej.exe

pid	process
1528	updatej.exe

description	pid	process
Token: SeDebugPrivilege	1528	updatej.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

634d7f8408d97c81dba3963924702d77.exeupdatej.exe

description	pid	process	target process
PID 648 wrote to memory of 2072	648	634d7f8408d97c81dba3963924702d77.exe	updatej.exe
PID 648 wrote to memory of 2072	648	634d7f8408d97c81dba3963924702d77.exe	updatej.exe
PID 648 wrote to memory of 2072	648	634d7f8408d97c81dba3963924702d77.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe
PID 2072 wrote to memory of 1528	2072	updatej.exe	updatej.exe

C:\Users\Admin\AppData\Local\Temp\634d7f8408d97c81dba3963924702d77.exe
"C:\Users\Admin\AppData\Local\Temp\634d7f8408d97c81dba3963924702d77.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Roaming\updatej.exe
C:\Users\Admin\AppData\Roaming\updatej.exe updatej
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Roaming\updatej.exe
"{path}"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Web Service

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\updatej.exe.log

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Roaming\updatej.exe

MD5
68f70e9545a6dbeecd3e2eba38c197ca

SHA1
5d0fdc7452e3af1c4d7b145256888687e5fd2a72

SHA256
a530aa8c670be7b56608fc342b9f98734d3c038d7dae02108d8073fe7cb85804

SHA512
99f9d31a72e1ba86fbe1d04020f95d8b83cf0edf2969051d327bb1144dc88eeb12b8afbe22ce050d39c45fa8b4dd4697c5962e45a6d7dda00468f2146aef4bc9

Download Submit
C:\Users\Admin\AppData\Roaming\updatej.exe

MD5
68f70e9545a6dbeecd3e2eba38c197ca

SHA1
5d0fdc7452e3af1c4d7b145256888687e5fd2a72

SHA256
a530aa8c670be7b56608fc342b9f98734d3c038d7dae02108d8073fe7cb85804

SHA512
99f9d31a72e1ba86fbe1d04020f95d8b83cf0edf2969051d327bb1144dc88eeb12b8afbe22ce050d39c45fa8b4dd4697c5962e45a6d7dda00468f2146aef4bc9

Download Submit
C:\Users\Admin\AppData\Roaming\updatej.exe

MD5
68f70e9545a6dbeecd3e2eba38c197ca

SHA1
5d0fdc7452e3af1c4d7b145256888687e5fd2a72

SHA256
a530aa8c670be7b56608fc342b9f98734d3c038d7dae02108d8073fe7cb85804

SHA512
99f9d31a72e1ba86fbe1d04020f95d8b83cf0edf2969051d327bb1144dc88eeb12b8afbe22ce050d39c45fa8b4dd4697c5962e45a6d7dda00468f2146aef4bc9

Download Submit
memory/1528-26-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/1528-29-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/1528-35-0x0000000006A70000-0x0000000006A71000-memory.dmp

Filesize
4KB

Download
memory/1528-32-0x0000000006F00000-0x0000000006F01000-memory.dmp

Filesize
4KB

Download
memory/1528-31-0x0000000006800000-0x0000000006801000-memory.dmp

Filesize
4KB

Download
memory/1528-30-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/1528-28-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/1528-27-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1528-25-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/1528-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1528-17-0x0000000000421DFE-mapping.dmp

Download
memory/1528-24-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/1528-23-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/1528-20-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-5-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-6-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2072-15-0x000000000ACA0000-0x000000000ACFE000-memory.dmp

Filesize
376KB

Download
memory/2072-2-0x0000000000000000-mapping.dmp

Download
memory/2072-14-0x0000000008510000-0x00000000085A6000-memory.dmp

Filesize
600KB

Download
memory/2072-8-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2072-13-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/2072-12-0x00000000082C0000-0x00000000082C1000-memory.dmp

Filesize
4KB

Download
memory/2072-11-0x00000000050F0000-0x00000000050F5000-memory.dmp

Filesize
20KB

Download
memory/2072-10-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/2072-9-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads