redline | f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa

General

Target

25cb91db7c054f9ba0f1479eb9f19e98.exe
Size

314KB
MD5

25cb91db7c054f9ba0f1479eb9f19e98
SHA1

ccbdeab113ca6f882f39f737df42797fbc64aca9
SHA256

f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa
SHA512

1c57d7382471d0d975dd36fbe10b7632734c87d147ac87b66acf6ddc7bf33dead25219a456cad4c320ec92b0051e8a2480a166a5fb807618c711d32c55017757

Score

10^/10

redline 118 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

118

C2

bumblebee2021.store:80

trusmileveneers.store:80

lazerprojekt.store:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2112-114-0x00000000009B0000-0x00000000009CE000-memory.dmp	family_redline
behavioral2/memory/2112-121-0x00000000049C0000-0x00000000049DD000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

25cb91db7c054f9ba0f1479eb9f19e98.exe

pid process

2112 25cb91db7c054f9ba0f1479eb9f19e98.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

25cb91db7c054f9ba0f1479eb9f19e98.exe

description pid process

Token: SeDebugPrivilege 2112 25cb91db7c054f9ba0f1479eb9f19e98.exe

pid	process
2112	25cb91db7c054f9ba0f1479eb9f19e98.exe

description	pid	process
Token: SeDebugPrivilege	2112	25cb91db7c054f9ba0f1479eb9f19e98.exe

C:\Users\Admin\AppData\Local\Temp\25cb91db7c054f9ba0f1479eb9f19e98.exe
"C:\Users\Admin\AppData\Local\Temp\25cb91db7c054f9ba0f1479eb9f19e98.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-114-0x00000000009B0000-0x00000000009CE000-memory.dmp

Filesize
120KB

Download
memory/2112-115-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/2112-116-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2112-117-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/2112-119-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/2112-118-0x0000000004A82000-0x0000000004A83000-memory.dmp

Filesize
4KB

Download
memory/2112-120-0x0000000004A83000-0x0000000004A84000-memory.dmp

Filesize
4KB

Download
memory/2112-121-0x00000000049C0000-0x00000000049DD000-memory.dmp

Filesize
116KB

Download
memory/2112-122-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/2112-123-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/2112-124-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/2112-125-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/2112-126-0x0000000004A84000-0x0000000004A86000-memory.dmp

Filesize
8KB

Download
memory/2112-127-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/2112-128-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/2112-129-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/2112-130-0x00000000066F0000-0x00000000066F1000-memory.dmp

Filesize
4KB

Download
memory/2112-131-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/2112-132-0x00000000076E0000-0x00000000076E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing