redline | d35d5b5ff516cdea2f6c27d47a7cf9d922bf14d4c3cef826c80f62aaad07afeb

General

Target
Minecraft_v3.2.exe
Size 204KB
Sample210715-e6asnhs4ve
SHA256 d35d5b5ff516cdea2f6c27d47a7cf9d922bf14d4c3cef826c80f62aaad07afeb
MD5 242a4e885799f3ee236c3c69ee1756d3
SHA1 1a0210297cb259e5b0a0750bf7eb3407a386836b
SHA512 25430d894ea4791edd1edabf757e4bb5a6c3626f552a58ea40c6c9df48ad9b3892dcc9013e54b13432f9579eb96817268b8e82f59cfadca53a709600b03c5279
MD5 SHA1 SHA512

Score

10^/10

redline ytmaloy4 agilenet discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ytmaloy4

C2

46.8.19.196:53773

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1276-66-0x0000000000417E9E-mapping.dmp	family_redline
behavioral1/memory/1276-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1276-67-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1688-63-0x0000000000250000-0x0000000000257000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1276	1688	Minecraft_v3.2.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	Minecraft_v3.2.exe
1276	Minecraft_v3.2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	Minecraft_v3.2.exe
Token: SeDebugPrivilege	1276	Minecraft_v3.2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29
PID 1688 wrote to memory of 1276	1688	Minecraft_v3.2.exe	29

C:\Users\Admin\AppData\Local\Temp\Minecraft_v3.2.exe
"C:\Users\Admin\AppData\Local\Temp\Minecraft_v3.2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\Minecraft_v3.2.exe
  C:\Users\Admin\AppData\Local\Temp\Minecraft_v3.2.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-65-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1276-67-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1276-69-0x0000000004260000-0x0000000004261000-memory.dmp

Download

memory/1688-60-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/1688-62-0x0000000075011000-0x0000000075013000-memory.dmp

Download

memory/1688-63-0x0000000000250000-0x0000000000257000-memory.dmp

Download

memory/1688-64-0x0000000000780000-0x0000000000781000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads