redline | be394c34bc2d5f532f3ddac7e2d692c60401d71858d4ae2f077af559f33ef772

General

Target

831d4e7f62efecd2fc159074383b965b.exe
Size

2.0MB
MD5

831d4e7f62efecd2fc159074383b965b
SHA1

4856dbaebf644b83f620fff1666f8553ad47d9b5
SHA256

be394c34bc2d5f532f3ddac7e2d692c60401d71858d4ae2f077af559f33ef772
SHA512

6e60c373cb7ace5666507dd58bf39c4c92346c070f6c4a2d62cd5966dd84bddee89034ba3ee4cce52df74fc0b0aede68d49fea29ee24f9698833905c853c88e8

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
9	checkip.amazonaws.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

831d4e7f62efecd2fc159074383b965b.exe

description	pid	Process	procid_target
PID 1652 set thread context of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

831d4e7f62efecd2fc159074383b965b.exeRegSvcs.exe

pid	Process
1652	831d4e7f62efecd2fc159074383b965b.exe
1652	831d4e7f62efecd2fc159074383b965b.exe
1652	831d4e7f62efecd2fc159074383b965b.exe
1652	831d4e7f62efecd2fc159074383b965b.exe
860	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

831d4e7f62efecd2fc159074383b965b.exeRegSvcs.exe

description	pid	Process
Token: SeDebugPrivilege	1652	831d4e7f62efecd2fc159074383b965b.exe
Token: SeDebugPrivilege	860	RegSvcs.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

831d4e7f62efecd2fc159074383b965b.exe

description	pid	Process	procid_target
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 756	1652	831d4e7f62efecd2fc159074383b965b.exe	29
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 568	1652	831d4e7f62efecd2fc159074383b965b.exe	30
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31
PID 1652 wrote to memory of 860	1652	831d4e7f62efecd2fc159074383b965b.exe	31

C:\Users\Admin\AppData\Local\Temp\831d4e7f62efecd2fc159074383b965b.exe
"C:\Users\Admin\AppData\Local\Temp\831d4e7f62efecd2fc159074383b965b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-16-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/860-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-13-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/860-12-0x000000000042B08E-mapping.dmp

Download
memory/1652-6-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1652-9-0x000000000A7E0000-0x000000000A8AC000-memory.dmp

Filesize
816KB

Download
memory/1652-10-0x000000000DD40000-0x000000000DDD1000-memory.dmp

Filesize
580KB

Download
memory/1652-8-0x0000000000A10000-0x0000000000A15000-memory.dmp

Filesize
20KB

Download
memory/1652-7-0x0000000008340000-0x0000000008407000-memory.dmp

Filesize
796KB

Download
memory/1652-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1652-5-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1652-3-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads