redline | cb9bdcab060d8b91eafa1dd442464cea40aa7a6547c02a4483f113f49c50ab18

General

Target

f859381cc1f43adaaefea79f640d9f3b.exe
Size

246KB
MD5

f859381cc1f43adaaefea79f640d9f3b
SHA1

d3b16cf09004f93976e9523cdb74f002ee443b68
SHA256

cb9bdcab060d8b91eafa1dd442464cea40aa7a6547c02a4483f113f49c50ab18
SHA512

f2f44098ed66ac5eb795eb8ef870b05f3888fdff60f41d834a2adf31559b1bf47ad2937fa22890cbfdd75a43257f0f8fc00eaa2ed6ab2bec3df6a5e96ec299c2

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

C2

zasavaucov.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2172-121-0x0000000000417DD6-mapping.dmp	family_redline
behavioral2/memory/2172-120-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

f859381cc1f43adaaefea79f640d9f3b.exe

description pid process target process

PID 3176 set thread context of 2172 3176 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f859381cc1f43adaaefea79f640d9f3b.exe

pid process

2172 f859381cc1f43adaaefea79f640d9f3b.exe
2172 f859381cc1f43adaaefea79f640d9f3b.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f859381cc1f43adaaefea79f640d9f3b.exef859381cc1f43adaaefea79f640d9f3b.exe

description pid process

Token: SeDebugPrivilege 3176 f859381cc1f43adaaefea79f640d9f3b.exe
Token: SeDebugPrivilege 2172 f859381cc1f43adaaefea79f640d9f3b.exe

description	pid	process	target process
PID 3176 set thread context of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe

pid	process
2172	f859381cc1f43adaaefea79f640d9f3b.exe
2172	f859381cc1f43adaaefea79f640d9f3b.exe

description	pid	process
Token: SeDebugPrivilege	3176	f859381cc1f43adaaefea79f640d9f3b.exe
Token: SeDebugPrivilege	2172	f859381cc1f43adaaefea79f640d9f3b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f859381cc1f43adaaefea79f640d9f3b.exe

description	pid	process	target process
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe
PID 3176 wrote to memory of 2172	3176	f859381cc1f43adaaefea79f640d9f3b.exe	f859381cc1f43adaaefea79f640d9f3b.exe

C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe
"C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe
  C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f859381cc1f43adaaefea79f640d9f3b.exe.log

MD5
7438b57da35c10c478469635b79e33e1

SHA1
5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

SHA256
b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

SHA512
5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

Download Submit
memory/2172-129-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/2172-131-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/2172-127-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/2172-128-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2172-121-0x0000000000417DD6-mapping.dmp

Download
memory/2172-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2172-126-0x00000000018E0000-0x00000000018E1000-memory.dmp

Filesize
4KB

Download
memory/2172-125-0x0000000005B90000-0x0000000005B91000-memory.dmp

Filesize
4KB

Download
memory/2172-135-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/2172-134-0x0000000006E20000-0x0000000006E21000-memory.dmp

Filesize
4KB

Download
memory/2172-133-0x0000000006A20000-0x0000000006A21000-memory.dmp

Filesize
4KB

Download
memory/2172-132-0x00000000071A0000-0x00000000071A1000-memory.dmp

Filesize
4KB

Download
memory/2172-130-0x0000000005580000-0x0000000005B86000-memory.dmp

Filesize
6.0MB

Download
memory/3176-117-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3176-114-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3176-119-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/3176-118-0x0000000004F20000-0x0000000004F2F000-memory.dmp

Filesize
60KB

Download
memory/3176-116-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing