redline | c6897ee5e6e0c63e0cf1866460859894664359d397f9d453546adf12c7794818

Analysis

max time kernel
33s
max time network
83s
platform
windows7_x64
resource
win7v20210410
submitted
11-08-2021 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install.exe
Size

317KB
MD5

cf31bb1b26f00448ed2f1359d403fa59
SHA1

22ab9cc3bdce1e177f5fac0e745229dacde1d07a
SHA256

1d322ad6c295b0ee8a552e96ac231c4d9259141c9ed22f7319c7f169eaecee71
SHA512

05541d9938c80c860e18cd29e3b708000fb90a89f217a1cf0faf2ced29c26dfb6dd395d12178e34f72ab386991f21cba71f8659fd99a649c81b4bf65ae86d998

Score

10^/10

redline asap discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

asap

45.14.49.109:54819

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral5/memory/368-63-0x0000000003020000-0x000000000303C000-memory.dmp	family_redline
behavioral5/memory/368-66-0x00000000033F0000-0x0000000005C76000-memory.dmp	family_redline
behavioral5/memory/368-67-0x0000000003310000-0x000000000332A000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Install.exe

pid process

368 Install.exe
368 Install.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Install.exe

description pid process

Token: SeDebugPrivilege 368 Install.exe
Token: SeRestorePrivilege 368 Install.exe
Token: SeBackupPrivilege 368 Install.exe

pid	process
368	Install.exe
368	Install.exe

description	pid	process
Token: SeDebugPrivilege	368	Install.exe
Token: SeRestorePrivilege	368	Install.exe
Token: SeBackupPrivilege	368	Install.exe

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-60-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/368-61-0x0000000000260000-0x000000000028F000-memory.dmp

Filesize
188KB

Download
memory/368-62-0x0000000000400000-0x0000000002C86000-memory.dmp

Filesize
40.5MB

Download
memory/368-63-0x0000000003020000-0x000000000303C000-memory.dmp

Filesize
112KB

Download
memory/368-64-0x00000000033F0000-0x0000000005C76000-memory.dmp

Filesize
40.5MB

Download
memory/368-65-0x00000000033F0000-0x0000000005C76000-memory.dmp

Filesize
40.5MB

Download
memory/368-66-0x00000000033F0000-0x0000000005C76000-memory.dmp

Filesize
40.5MB

Download
memory/368-67-0x0000000003310000-0x000000000332A000-memory.dmp

Filesize
104KB

Download
memory/368-68-0x00000000033F0000-0x0000000005C76000-memory.dmp

Filesize
40.5MB

Download