redline | fad0ca06bacf9f247ac03d9366abd3ac41415e56af0ea16bdff70f6ca77ed41a

Analysis

max time kernel
30s
max time network
122s
platform
windows10_x64
resource
win10v20210408
submitted
20-08-2021 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb05824f223c928ba39e91fe17364438.exe
Size

105KB
MD5

fb05824f223c928ba39e91fe17364438
SHA1

88c1f712f00ab3bb533b2e9e3c778f50e2147204
SHA256

fad0ca06bacf9f247ac03d9366abd3ac41415e56af0ea16bdff70f6ca77ed41a
SHA512

306e562ac8d71a0c93184a389648d07efb33116ca96a2427f5032e873fc593a5dd6fc5df6a3c5bd4e2e32043bbc6872235688e8c6763194f00a55c3206837df8

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fb05824f223c928ba39e91fe17364438.exe

pid process

804 fb05824f223c928ba39e91fe17364438.exe
804 fb05824f223c928ba39e91fe17364438.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fb05824f223c928ba39e91fe17364438.exe

description pid process

Token: SeDebugPrivilege 804 fb05824f223c928ba39e91fe17364438.exe

pid	process
804	fb05824f223c928ba39e91fe17364438.exe
804	fb05824f223c928ba39e91fe17364438.exe

description	pid	process
Token: SeDebugPrivilege	804	fb05824f223c928ba39e91fe17364438.exe

C:\Users\Admin\AppData\Local\Temp\fb05824f223c928ba39e91fe17364438.exe
"C:\Users\Admin\AppData\Local\Temp\fb05824f223c928ba39e91fe17364438.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/804-116-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/804-117-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/804-118-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/804-119-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/804-120-0x0000000005200000-0x0000000005806000-memory.dmp

Filesize
6.0MB

Download
memory/804-121-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/804-122-0x0000000006810000-0x0000000006811000-memory.dmp

Filesize
4KB

Download
memory/804-123-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/804-124-0x00000000069E0000-0x00000000069E1000-memory.dmp

Filesize
4KB

Download
memory/804-125-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/804-126-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/804-127-0x0000000006D60000-0x0000000006D61000-memory.dmp

Filesize
4KB

Download
memory/804-128-0x0000000006D00000-0x0000000006D01000-memory.dmp

Filesize
4KB

Download