redline | aae3cdeedc940844c30f81a0df1c1da150fc890c604fc81f0f81da729831e51f

General

Target

Updbdate.exe
Size

332KB
MD5

e0d7a00d5d1d17d549330622d5efbc57
SHA1

e3abe1626a305c75b223bc17a9de9245290c1571
SHA256

aae3cdeedc940844c30f81a0df1c1da150fc890c604fc81f0f81da729831e51f
SHA512

8931fd7e2b00fe4fc3386eaaf8bfd0d30005e5fda3795d105a866505c83e3c5aca59725a5d8dd6369cc43a426920f6eab1f9fc62e40755ea7c905ec9d27464da

Score

10^/10

redline upd discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

UPD

C2

193.56.146.78:54955

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/992-116-0x0000000004320000-0x000000000433C000-memory.dmp	family_redline
behavioral2/memory/992-121-0x0000000004390000-0x00000000043AA000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Updbdate.exe

pid process

992 Updbdate.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Updbdate.exe

description pid process

Token: SeDebugPrivilege 992 Updbdate.exe

pid	process
992	Updbdate.exe

description	pid	process
Token: SeDebugPrivilege	992	Updbdate.exe

C:\Users\Admin\AppData\Local\Temp\Updbdate.exe
"C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-115-0x0000000000400000-0x00000000023BE000-memory.dmp

Filesize
31.7MB

Download
memory/992-114-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/992-116-0x0000000004320000-0x000000000433C000-memory.dmp

Filesize
112KB

Download
memory/992-117-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/992-118-0x0000000006B00000-0x0000000006B01000-memory.dmp

Filesize
4KB

Download
memory/992-119-0x0000000004372000-0x0000000004373000-memory.dmp

Filesize
4KB

Download
memory/992-120-0x0000000004373000-0x0000000004374000-memory.dmp

Filesize
4KB

Download
memory/992-121-0x0000000004390000-0x00000000043AA000-memory.dmp

Filesize
104KB

Download
memory/992-122-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/992-123-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/992-124-0x0000000007630000-0x0000000007631000-memory.dmp

Filesize
4KB

Download
memory/992-125-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/992-126-0x0000000004374000-0x0000000004376000-memory.dmp

Filesize
8KB

Download
memory/992-127-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/992-128-0x00000000084F0000-0x00000000084F1000-memory.dmp

Filesize
4KB

Download
memory/992-129-0x00000000086C0000-0x00000000086C1000-memory.dmp

Filesize
4KB

Download
memory/992-130-0x0000000008CF0000-0x0000000008CF1000-memory.dmp

Filesize
4KB

Download
memory/992-131-0x0000000009050000-0x0000000009051000-memory.dmp

Filesize
4KB

Download
memory/992-132-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/992-133-0x0000000009200000-0x0000000009201000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing