redline | f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa

General

Target

25cb91db7c054f9ba0f1479eb9f19e98.exe
Size

314KB
MD5

25cb91db7c054f9ba0f1479eb9f19e98
SHA1

ccbdeab113ca6f882f39f737df42797fbc64aca9
SHA256

f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa
SHA512

1c57d7382471d0d975dd36fbe10b7632734c87d147ac87b66acf6ddc7bf33dead25219a456cad4c320ec92b0051e8a2480a166a5fb807618c711d32c55017757

Score

10^/10

redline 118 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

118

C2

bumblebee2021.store:80

trusmileveneers.store:80

lazerprojekt.store:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4656-116-0x0000000000A40000-0x0000000000A5E000-memory.dmp	family_redline
behavioral2/memory/4656-121-0x0000000002390000-0x00000000023AD000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

25cb91db7c054f9ba0f1479eb9f19e98.exe

pid process

4656 25cb91db7c054f9ba0f1479eb9f19e98.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

25cb91db7c054f9ba0f1479eb9f19e98.exe

description pid process

Token: SeDebugPrivilege 4656 25cb91db7c054f9ba0f1479eb9f19e98.exe

pid	process
4656	25cb91db7c054f9ba0f1479eb9f19e98.exe

description	pid	process
Token: SeDebugPrivilege	4656	25cb91db7c054f9ba0f1479eb9f19e98.exe

C:\Users\Admin\AppData\Local\Temp\25cb91db7c054f9ba0f1479eb9f19e98.exe
"C:\Users\Admin\AppData\Local\Temp\25cb91db7c054f9ba0f1479eb9f19e98.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4656-114-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/4656-115-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4656-116-0x0000000000A40000-0x0000000000A5E000-memory.dmp

Filesize
120KB

Download
memory/4656-118-0x0000000004B22000-0x0000000004B23000-memory.dmp

Filesize
4KB

Download
memory/4656-117-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/4656-119-0x0000000004B23000-0x0000000004B24000-memory.dmp

Filesize
4KB

Download
memory/4656-120-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/4656-121-0x0000000002390000-0x00000000023AD000-memory.dmp

Filesize
116KB

Download
memory/4656-122-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4656-123-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4656-124-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/4656-125-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/4656-126-0x0000000004B24000-0x0000000004B26000-memory.dmp

Filesize
8KB

Download
memory/4656-127-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4656-128-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/4656-129-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/4656-130-0x00000000066F0000-0x00000000066F1000-memory.dmp

Filesize
4KB

Download
memory/4656-131-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/4656-132-0x0000000007570000-0x0000000007571000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing