redline | 5ef6a3e8a70847b098a042ce963d12ec6e777c0c335b33d64e232912807af219

General

Target

84867D3DACCDEC9B8D2A10CA4EC9EF45.exe
Size

260KB
MD5

84867d3daccdec9b8d2a10ca4ec9ef45
SHA1

432e3a5a463f2ec7b18beca594a9f357839c4ed2
SHA256

5ef6a3e8a70847b098a042ce963d12ec6e777c0c335b33d64e232912807af219
SHA512

dd7e6307d54f43e3430c3853b1fda0d944fb164f7e1f0257bb1aa59a6a8430355c2d461e70d20a9556994d68da3404b69b2814226e41090f330f7e23474ac045

Score

10^/10

redline 170 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

170

C2

147.124.222.75:42864

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/996-117-0x0000000000CA0000-0x0000000000CBB000-memory.dmp	family_redline
behavioral2/memory/996-119-0x00000000028B0000-0x00000000028C9000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

84867D3DACCDEC9B8D2A10CA4EC9EF45.exe

pid process

996 84867D3DACCDEC9B8D2A10CA4EC9EF45.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

84867D3DACCDEC9B8D2A10CA4EC9EF45.exe

description pid process

Token: SeDebugPrivilege 996 84867D3DACCDEC9B8D2A10CA4EC9EF45.exe

pid	process
996	84867D3DACCDEC9B8D2A10CA4EC9EF45.exe

description	pid	process
Token: SeDebugPrivilege	996	84867D3DACCDEC9B8D2A10CA4EC9EF45.exe

C:\Users\Admin\AppData\Local\Temp\84867D3DACCDEC9B8D2A10CA4EC9EF45.exe
"C:\Users\Admin\AppData\Local\Temp\84867D3DACCDEC9B8D2A10CA4EC9EF45.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-114-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/996-116-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/996-115-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/996-117-0x0000000000CA0000-0x0000000000CBB000-memory.dmp

Filesize
108KB

Download
memory/996-118-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/996-119-0x00000000028B0000-0x00000000028C9000-memory.dmp

Filesize
100KB

Download
memory/996-120-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/996-122-0x0000000005203000-0x0000000005204000-memory.dmp

Filesize
4KB

Download
memory/996-121-0x0000000005202000-0x0000000005203000-memory.dmp

Filesize
4KB

Download
memory/996-123-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/996-124-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/996-125-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/996-126-0x0000000005204000-0x0000000005206000-memory.dmp

Filesize
8KB

Download
memory/996-127-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/996-128-0x00000000069E0000-0x00000000069E1000-memory.dmp

Filesize
4KB

Download
memory/996-129-0x0000000006BB0000-0x0000000006BB1000-memory.dmp

Filesize
4KB

Download
memory/996-130-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/996-131-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing