redline | 0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57

General

Target

133E916268D3F97CA4E2751A1C8BCB1A.exe
Size

433KB
MD5

133e916268d3f97ca4e2751a1c8bcb1a
SHA1

fcacac94431f772151f206400f255c3b493f14ea
SHA256

0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57
SHA512

4f7b2ee402b16bde1cd32623237d556811d56204cb227f1df9be9479624b27abd36fd35e7e69e5d3123ee1541f4ba7592fd5d19f607e4bc64de6d7ff50f3e2bd

Score

10^/10

redline pub11-1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

PUB11-1

C2

shapkishop.store:80

razorless-shaving.store:80

fugicarfc8.store:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4436-114-0x0000000002200000-0x000000000221F000-memory.dmp	family_redline
behavioral2/memory/4436-116-0x00000000022A0000-0x00000000022BD000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

133E916268D3F97CA4E2751A1C8BCB1A.exe

pid process

4436 133E916268D3F97CA4E2751A1C8BCB1A.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

133E916268D3F97CA4E2751A1C8BCB1A.exe

description pid process

Token: SeDebugPrivilege 4436 133E916268D3F97CA4E2751A1C8BCB1A.exe

pid	process
4436	133E916268D3F97CA4E2751A1C8BCB1A.exe

description	pid	process
Token: SeDebugPrivilege	4436	133E916268D3F97CA4E2751A1C8BCB1A.exe

C:\Users\Admin\AppData\Local\Temp\133E916268D3F97CA4E2751A1C8BCB1A.exe
"C:\Users\Admin\AppData\Local\Temp\133E916268D3F97CA4E2751A1C8BCB1A.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-114-0x0000000002200000-0x000000000221F000-memory.dmp

Filesize
124KB

Download
memory/4436-115-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/4436-116-0x00000000022A0000-0x00000000022BD000-memory.dmp

Filesize
116KB

Download
memory/4436-117-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/4436-118-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4436-119-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4436-120-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/4436-122-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/4436-123-0x0000000004C92000-0x0000000004C93000-memory.dmp

Filesize
4KB

Download
memory/4436-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4436-124-0x0000000004C93000-0x0000000004C94000-memory.dmp

Filesize
4KB

Download
memory/4436-125-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4436-126-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/4436-127-0x0000000004C94000-0x0000000004C96000-memory.dmp

Filesize
8KB

Download
memory/4436-128-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/4436-129-0x0000000006570000-0x0000000006571000-memory.dmp

Filesize
4KB

Download
memory/4436-130-0x0000000006740000-0x0000000006741000-memory.dmp

Filesize
4KB

Download
memory/4436-131-0x0000000006D50000-0x0000000006D51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing