redline | ede7098a421db325ec6704d3dcf0e91f26787fea3ff2215dca12b8160e22ec80

General

Target

invice-PDF.exe
Size

328KB
MD5

834d0436e95f39ceedc7cd44f1cdf783
SHA1

3e75f3e0cc374b764be385f2080319d24dd2e1f6
SHA256

ede7098a421db325ec6704d3dcf0e91f26787fea3ff2215dca12b8160e22ec80
SHA512

0350ae6a29b7c3bb8e51386482343a728eec280cec949ab8c0a76072fa46a9efbda9082c3a887da40b2cc97ed56850315f90b6717900c8b0db2e350db27a265e

Score

10^/10

redline v1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

v1

C2

176.10.118.231:54808

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1420-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1420-64-0x0000000000418F8E-mapping.dmp	family_redline
behavioral1/memory/1420-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

invice-PDF.exe

description pid process target process

PID 288 set thread context of 1420 288 invice-PDF.exe invice-PDF.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

596 1420 WerFault.exe invice-PDF.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

invice-PDF.exeWerFault.exe

pid process

1420 invice-PDF.exe
596 WerFault.exe
596 WerFault.exe
596 WerFault.exe
596 WerFault.exe
596 WerFault.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

invice-PDF.exeinvice-PDF.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 288 invice-PDF.exe
Token: SeDebugPrivilege 1420 invice-PDF.exe
Token: SeDebugPrivilege 596 WerFault.exe

description	pid	process	target process
PID 288 set thread context of 1420	288	invice-PDF.exe	invice-PDF.exe

pid	pid_target	process	target process
596	1420	WerFault.exe	invice-PDF.exe

pid	process
1420	invice-PDF.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	288	invice-PDF.exe
Token: SeDebugPrivilege	1420	invice-PDF.exe
Token: SeDebugPrivilege	596	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

invice-PDF.exeinvice-PDF.exe

description	pid	process	target process
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 288 wrote to memory of 1420	288	invice-PDF.exe	invice-PDF.exe
PID 1420 wrote to memory of 596	1420	invice-PDF.exe	WerFault.exe
PID 1420 wrote to memory of 596	1420	invice-PDF.exe	WerFault.exe
PID 1420 wrote to memory of 596	1420	invice-PDF.exe	WerFault.exe
PID 1420 wrote to memory of 596	1420	invice-PDF.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\invice-PDF.exe
"C:\Users\Admin\AppData\Local\Temp\invice-PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\invice-PDF.exe
C:\Users\Admin\AppData\Local\Temp\invice-PDF.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1828
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-59-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/288-61-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/288-62-0x0000000001F80000-0x0000000001FA1000-memory.dmp

Filesize
132KB

Download
memory/596-68-0x0000000000000000-mapping.dmp

Download
memory/596-69-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1420-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1420-64-0x0000000000418F8E-mapping.dmp

Download
memory/1420-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1420-67-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing