redline | 9e9a5392630865e8b66892cd096777695272a9bf4abdc0212b1a85c7358e588f

General

Target

b260d3cd311e85ab554db53a3eadc775.exe
Size

250KB
MD5

b260d3cd311e85ab554db53a3eadc775
SHA1

74eb59b69da8eea418db7d436a994a86461098b3
SHA256

9e9a5392630865e8b66892cd096777695272a9bf4abdc0212b1a85c7358e588f
SHA512

b894d5041304daa82d8977a9c4bba17bf89ab593bd82d61ade12fe1417551ac801231f98151b4c5bce5a47ab0040b7f4c3d2ae328f130dad9a7811b85e3fa7ed

Score

10^/10

redline инсталлусы5к discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Инсталлусы5к

C2

91.142.77.155:5469

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/656-116-0x00000000025A0000-0x00000000025BF000-memory.dmp	family_redline
behavioral2/memory/656-119-0x0000000004050000-0x000000000406E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b260d3cd311e85ab554db53a3eadc775.exe

pid process

656 b260d3cd311e85ab554db53a3eadc775.exe
656 b260d3cd311e85ab554db53a3eadc775.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b260d3cd311e85ab554db53a3eadc775.exe

description pid process

Token: SeDebugPrivilege 656 b260d3cd311e85ab554db53a3eadc775.exe

pid	process
656	b260d3cd311e85ab554db53a3eadc775.exe
656	b260d3cd311e85ab554db53a3eadc775.exe

description	pid	process
Token: SeDebugPrivilege	656	b260d3cd311e85ab554db53a3eadc775.exe

C:\Users\Admin\AppData\Local\Temp\b260d3cd311e85ab554db53a3eadc775.exe
"C:\Users\Admin\AppData\Local\Temp\b260d3cd311e85ab554db53a3eadc775.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/656-115-0x0000000000400000-0x000000000215C000-memory.dmp

Filesize
29.4MB

Download
memory/656-116-0x00000000025A0000-0x00000000025BF000-memory.dmp

Filesize
124KB

Download
memory/656-117-0x00000000069E0000-0x00000000069E1000-memory.dmp

Filesize
4KB

Download
memory/656-118-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download
memory/656-119-0x0000000004050000-0x000000000406E000-memory.dmp

Filesize
120KB

Download
memory/656-120-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/656-122-0x00000000069E3000-0x00000000069E4000-memory.dmp

Filesize
4KB

Download
memory/656-121-0x00000000069E2000-0x00000000069E3000-memory.dmp

Filesize
4KB

Download
memory/656-123-0x0000000004110000-0x0000000004111000-memory.dmp

Filesize
4KB

Download
memory/656-124-0x0000000006810000-0x0000000006811000-memory.dmp

Filesize
4KB

Download
memory/656-125-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/656-126-0x00000000069E4000-0x00000000069E6000-memory.dmp

Filesize
8KB

Download
memory/656-127-0x0000000006920000-0x0000000006921000-memory.dmp

Filesize
4KB

Download
memory/656-128-0x0000000008630000-0x0000000008631000-memory.dmp

Filesize
4KB

Download
memory/656-129-0x0000000008800000-0x0000000008801000-memory.dmp

Filesize
4KB

Download
memory/656-130-0x0000000008DB0000-0x0000000008DB1000-memory.dmp

Filesize
4KB

Download
memory/656-131-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Filesize
4KB

Download
memory/656-132-0x0000000009070000-0x0000000009071000-memory.dmp

Filesize
4KB

Download
memory/656-133-0x0000000009100000-0x0000000009101000-memory.dmp

Filesize
4KB

Download
memory/656-134-0x0000000009690000-0x0000000009691000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing