redline | 9e9a5392630865e8b66892cd096777695272a9bf4abdc0212b1a85c7358e588f

General

Target

b260d3cd311e85ab554db53a3eadc775.exe
Size

250KB
MD5

b260d3cd311e85ab554db53a3eadc775
SHA1

74eb59b69da8eea418db7d436a994a86461098b3
SHA256

9e9a5392630865e8b66892cd096777695272a9bf4abdc0212b1a85c7358e588f
SHA512

b894d5041304daa82d8977a9c4bba17bf89ab593bd82d61ade12fe1417551ac801231f98151b4c5bce5a47ab0040b7f4c3d2ae328f130dad9a7811b85e3fa7ed

Score

10^/10

redline инсталлусы5к discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Инсталлусы5к

C2

91.142.77.155:5469

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3264-116-0x00000000024A0000-0x00000000024BF000-memory.dmp	family_redline
behavioral2/memory/3264-122-0x0000000004130000-0x000000000414E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b260d3cd311e85ab554db53a3eadc775.exe

pid process

3264 b260d3cd311e85ab554db53a3eadc775.exe
3264 b260d3cd311e85ab554db53a3eadc775.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b260d3cd311e85ab554db53a3eadc775.exe

description pid process

Token: SeDebugPrivilege 3264 b260d3cd311e85ab554db53a3eadc775.exe

pid	process
3264	b260d3cd311e85ab554db53a3eadc775.exe
3264	b260d3cd311e85ab554db53a3eadc775.exe

description	pid	process
Token: SeDebugPrivilege	3264	b260d3cd311e85ab554db53a3eadc775.exe

C:\Users\Admin\AppData\Local\Temp\b260d3cd311e85ab554db53a3eadc775.exe
"C:\Users\Admin\AppData\Local\Temp\b260d3cd311e85ab554db53a3eadc775.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3264-115-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/3264-116-0x00000000024A0000-0x00000000024BF000-memory.dmp

Filesize
124KB

Download
memory/3264-118-0x0000000006870000-0x0000000006871000-memory.dmp

Filesize
4KB

Download
memory/3264-117-0x0000000000400000-0x000000000215C000-memory.dmp

Filesize
29.4MB

Download
memory/3264-119-0x0000000006872000-0x0000000006873000-memory.dmp

Filesize
4KB

Download
memory/3264-120-0x0000000006873000-0x0000000006874000-memory.dmp

Filesize
4KB

Download
memory/3264-121-0x0000000006880000-0x0000000006881000-memory.dmp

Filesize
4KB

Download
memory/3264-122-0x0000000004130000-0x000000000414E000-memory.dmp

Filesize
120KB

Download
memory/3264-123-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/3264-124-0x0000000006730000-0x0000000006731000-memory.dmp

Filesize
4KB

Download
memory/3264-125-0x0000000006760000-0x0000000006761000-memory.dmp

Filesize
4KB

Download
memory/3264-126-0x0000000007390000-0x0000000007391000-memory.dmp

Filesize
4KB

Download
memory/3264-127-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/3264-128-0x0000000006874000-0x0000000006876000-memory.dmp

Filesize
8KB

Download
memory/3264-129-0x0000000008630000-0x0000000008631000-memory.dmp

Filesize
4KB

Download
memory/3264-130-0x0000000008800000-0x0000000008801000-memory.dmp

Filesize
4KB

Download
memory/3264-131-0x0000000008E20000-0x0000000008E21000-memory.dmp

Filesize
4KB

Download
memory/3264-132-0x00000000091E0000-0x00000000091E1000-memory.dmp

Filesize
4KB

Download
memory/3264-133-0x00000000092B0000-0x00000000092B1000-memory.dmp

Filesize
4KB

Download
memory/3264-134-0x0000000009270000-0x0000000009271000-memory.dmp

Filesize
4KB

Download
memory/3264-135-0x0000000009880000-0x0000000009881000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing