redline | 54deea77c66f31b5b2ae101d942ddc0acd04a146f1dadf85f80034e1f6edd567

General

Target

8fa76cd75fe02c1093f254977f44ee79.exe
Size

394KB
MD5

8fa76cd75fe02c1093f254977f44ee79
SHA1

dfa7b0b4d24a93e4463921dbc7886e84dfd60495
SHA256

54deea77c66f31b5b2ae101d942ddc0acd04a146f1dadf85f80034e1f6edd567
SHA512

37cf4197dd1a2069382c11997c644bea869968beeae55b03b47040372f8dcb1faa75c858916b38e589c6735ef94e912590943ff97691713d6e44760380ac1c74

Score

10^/10

redline @soul3ss infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@soul3ss

C2

188.130.139.12:23747

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/196-114-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/196-119-0x0000000000418FC6-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 772 created 396 772 WerFault.exe 8fa76cd75fe02c1093f254977f44ee79.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

8fa76cd75fe02c1093f254977f44ee79.exe

description pid process target process

PID 396 set thread context of 196 396 8fa76cd75fe02c1093f254977f44ee79.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

772 396 WerFault.exe 8fa76cd75fe02c1093f254977f44ee79.exe

description	pid	process	target process
PID 772 created 396	772	WerFault.exe	8fa76cd75fe02c1093f254977f44ee79.exe

description	pid	process	target process
PID 396 set thread context of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe

pid	pid_target	process	target process
772	396	WerFault.exe	8fa76cd75fe02c1093f254977f44ee79.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WerFault.exeRegSvcs.exe

pid	process
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
196	RegSvcs.exe
196	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exeRegSvcs.exe

description	pid	process
Token: SeRestorePrivilege	772	WerFault.exe
Token: SeBackupPrivilege	772	WerFault.exe
Token: SeDebugPrivilege	772	WerFault.exe
Token: SeDebugPrivilege	196	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8fa76cd75fe02c1093f254977f44ee79.exe

description	pid	process	target process
PID 396 wrote to memory of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe
PID 396 wrote to memory of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe
PID 396 wrote to memory of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe
PID 396 wrote to memory of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe
PID 396 wrote to memory of 196	396	8fa76cd75fe02c1093f254977f44ee79.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\8fa76cd75fe02c1093f254977f44ee79.exe
"C:\Users\Admin\AppData\Local\Temp\8fa76cd75fe02c1093f254977f44ee79.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 244
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/196-114-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/196-119-0x0000000000418FC6-mapping.dmp

Download
memory/196-120-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/196-122-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/196-123-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/196-124-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/196-125-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/196-126-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/196-127-0x00000000077D0000-0x00000000077D1000-memory.dmp

Filesize
4KB

Download
memory/196-128-0x0000000005070000-0x000000000556E000-memory.dmp

Filesize
5.0MB

Download
memory/196-129-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/196-130-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/196-131-0x0000000008670000-0x0000000008671000-memory.dmp

Filesize
4KB

Download
memory/196-132-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Filesize
4KB

Download
memory/196-133-0x00000000083E0000-0x00000000083E1000-memory.dmp

Filesize
4KB

Download
memory/196-134-0x00000000084E0000-0x00000000084E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads