redline | fe28808f8b07b484ff987a1ccc2f187857139e84d58dfbbb8004ce29f21bf1ea

General

Target

9901d90330c9d140262d6741a7ba3de7.exe
Size

671KB
MD5

9901d90330c9d140262d6741a7ba3de7
SHA1

c68de5eaaf9e9e34acaac51b83c9ddc36798dbd8
SHA256

fe28808f8b07b484ff987a1ccc2f187857139e84d58dfbbb8004ce29f21bf1ea
SHA512

29623777cdf0d78e6193f31cdff84165ec1958683c487c550314721952d9ec943f7a09fa405e6b518e9443dc1d47cdba7fb9dc2a324994020c58f587132fd1f6

Score

10^/10

redline arind1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

Arind1

C2

195.2.84.82:56801

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1908-64-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1908-65-0x0000000000416392-mapping.dmp	family_redline
behavioral1/memory/1908-66-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

tempfl.exe

pid process

872 tempfl.exe
Loads dropped DLL 6 IoCs

Processes:

AddInProcess32.exeWerFault.exe

pid process

1908 AddInProcess32.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

9901d90330c9d140262d6741a7ba3de7.exe

description pid process target process

PID 1116 set thread context of 1908 1116 9901d90330c9d140262d6741a7ba3de7.exe AddInProcess32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

868 872 WerFault.exe tempfl.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

AddInProcess32.exeWerFault.exe

pid process

1908 AddInProcess32.exe
1908 AddInProcess32.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

868 WerFault.exe

pid	process
872	tempfl.exe

pid	process
1908	AddInProcess32.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe

description	pid	process	target process
PID 1116 set thread context of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe

pid	pid_target	process	target process
868	872	WerFault.exe	tempfl.exe

pid	process
1908	AddInProcess32.exe
1908	AddInProcess32.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe
868	WerFault.exe

pid	process
868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

9901d90330c9d140262d6741a7ba3de7.exeAddInProcess32.exetempfl.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1116	9901d90330c9d140262d6741a7ba3de7.exe
Token: SeDebugPrivilege	1908	AddInProcess32.exe
Token: SeDebugPrivilege	872	tempfl.exe
Token: SeDebugPrivilege	868	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

9901d90330c9d140262d6741a7ba3de7.exeAddInProcess32.exetempfl.exe

description	pid	process	target process
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1116 wrote to memory of 1908	1116	9901d90330c9d140262d6741a7ba3de7.exe	AddInProcess32.exe
PID 1908 wrote to memory of 872	1908	AddInProcess32.exe	tempfl.exe
PID 1908 wrote to memory of 872	1908	AddInProcess32.exe	tempfl.exe
PID 1908 wrote to memory of 872	1908	AddInProcess32.exe	tempfl.exe
PID 1908 wrote to memory of 872	1908	AddInProcess32.exe	tempfl.exe
PID 872 wrote to memory of 868	872	tempfl.exe	WerFault.exe
PID 872 wrote to memory of 868	872	tempfl.exe	WerFault.exe
PID 872 wrote to memory of 868	872	tempfl.exe	WerFault.exe
PID 872 wrote to memory of 868	872	tempfl.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9901d90330c9d140262d6741a7ba3de7.exe
"C:\Users\Admin\AppData\Local\Temp\9901d90330c9d140262d6741a7ba3de7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\tempfl.exe
"C:\Users\Admin\AppData\Local\Temp\tempfl.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 1084
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
\Users\Admin\AppData\Local\Temp\tempfl.exe
MD5
5906f76fc4bb834ba09213b795bb328d

SHA1
8139dc1a4a9113b58f33e02bdb1b388c36c43e38

SHA256
360c9a9c25a6348d9552545374b184fa54cc91c1a3b386a06d9c63d56748cc36

SHA512
247ec1494bb6b4cdf01743b7c7b67727f6606639f129c73ff9a7288c38a2de6346ae7367e6fdce4128355ef4956eec6f07ddefceb2e412f82a0be3f2f3991e91

Download Submit
memory/868-76-0x0000000000000000-mapping.dmp

Download
memory/868-82-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/872-73-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/872-75-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/872-70-0x0000000000000000-mapping.dmp

Download
memory/1116-63-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1116-62-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/1116-60-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1908-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-65-0x0000000000416392-mapping.dmp

Download
memory/1908-68-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads