redline | cacc3559c7ae7b8f5a4210016f13b9fbfe2a1d457edb4b013a5b5434956174e9

General

Target

CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
Size

572KB
MD5

59f3f9d13f2bdfe94922bfaf59ce1f7b
SHA1

b27083417010591f72a752dfc720ac46d3680117
SHA256

cacc3559c7ae7b8f5a4210016f13b9fbfe2a1d457edb4b013a5b5434956174e9
SHA512

c1741a86a0840eac5abd533e60f65642bcd412fa039f95982e20a2fe7fa05f2e05d331954980369ec28a60199e7fc4bf9d304b0b847433874145261dcebef6f8

Score

10^/10

redline @morganatic_ll infostealer

Malware Config

Extracted

Family

redline

Botnet

@morganatic_ll

C2

18.117.82.8:58546

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1984-65-0x0000000000417DEA-mapping.dmp	family_redline
behavioral1/memory/1984-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1984-66-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

description	pid	process	target process
PID 2004 set thread context of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exeCACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

description	pid	process
Token: SeDebugPrivilege	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
Token: SeDebugPrivilege	1984	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

description	pid	process	target process
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
PID 2004 wrote to memory of 1984	2004	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe	CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe

C:\Users\Admin\AppData\Local\Temp\CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
"C:\Users\Admin\AppData\Local\Temp\CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
C:\Users\Admin\AppData\Local\Temp\CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-65-0x0000000000417DEA-mapping.dmp

Download
memory/1984-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-69-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/2004-60-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/2004-62-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/2004-63-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads