redline | e8bdf4c9cc244c3fb0429bf936988196560ae9374b36974bcb8be94b0df69777

General

Target

f82881e7046ce7976557f8958254aa80.exe
Size

248KB
MD5

f82881e7046ce7976557f8958254aa80
SHA1

69ce60a71e901a618b310cc939939776ff3ec269
SHA256

e8bdf4c9cc244c3fb0429bf936988196560ae9374b36974bcb8be94b0df69777
SHA512

de3b92bd2eaeceb1f760eff6fd0ed1d72e5d9085feb27fdb5103fd89308108df37e7ea39c8243829117a23be1bed01c92b120fc3f77115dd9e87fda728d0f16c

Score

10^/10

redline build1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

build1

C2

65.108.48.203:48896

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1032-117-0x0000000003A50000-0x0000000003A6F000-memory.dmp	family_redline
behavioral2/memory/1032-121-0x00000000067D0000-0x00000000067EE000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f82881e7046ce7976557f8958254aa80.exe

pid process

1032 f82881e7046ce7976557f8958254aa80.exe
1032 f82881e7046ce7976557f8958254aa80.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f82881e7046ce7976557f8958254aa80.exe

description pid process

Token: SeDebugPrivilege 1032 f82881e7046ce7976557f8958254aa80.exe

pid	process
1032	f82881e7046ce7976557f8958254aa80.exe
1032	f82881e7046ce7976557f8958254aa80.exe

description	pid	process
Token: SeDebugPrivilege	1032	f82881e7046ce7976557f8958254aa80.exe

C:\Users\Admin\AppData\Local\Temp\f82881e7046ce7976557f8958254aa80.exe
"C:\Users\Admin\AppData\Local\Temp\f82881e7046ce7976557f8958254aa80.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -s BITS
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-115-0x0000000000400000-0x0000000001D89000-memory.dmp

Filesize
25.5MB

Download
memory/1032-114-0x0000000001EB0000-0x0000000001FFA000-memory.dmp

Filesize
1.3MB

Download
memory/1032-116-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/1032-117-0x0000000003A50000-0x0000000003A6F000-memory.dmp

Filesize
124KB

Download
memory/1032-118-0x0000000003A72000-0x0000000003A73000-memory.dmp

Filesize
4KB

Download
memory/1032-119-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1032-120-0x0000000003A73000-0x0000000003A74000-memory.dmp

Filesize
4KB

Download
memory/1032-121-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/1032-122-0x0000000006930000-0x0000000006931000-memory.dmp

Filesize
4KB

Download
memory/1032-123-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

Filesize
4KB

Download
memory/1032-124-0x0000000007080000-0x0000000007081000-memory.dmp

Filesize
4KB

Download
memory/1032-125-0x00000000070A0000-0x00000000070A1000-memory.dmp

Filesize
4KB

Download
memory/1032-126-0x0000000003A74000-0x0000000003A76000-memory.dmp

Filesize
8KB

Download
memory/1032-127-0x00000000087B0000-0x00000000087B1000-memory.dmp

Filesize
4KB

Download
memory/1032-128-0x0000000009430000-0x0000000009431000-memory.dmp

Filesize
4KB

Download
memory/1032-129-0x00000000071E0000-0x00000000071E1000-memory.dmp

Filesize
4KB

Download
memory/1032-130-0x0000000009B90000-0x0000000009B91000-memory.dmp

Filesize
4KB

Download
memory/1032-131-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/1032-132-0x000000000A310000-0x000000000A311000-memory.dmp

Filesize
4KB

Download
memory/1032-133-0x000000000A400000-0x000000000A401000-memory.dmp

Filesize
4KB

Download
memory/1032-134-0x000000000B200000-0x000000000B201000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing