redline | 44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65

General

Target

44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe
Size

318KB
MD5

be7d0939c5c4fe422733dfe5c7ac8d3b
SHA1

5ee0eff03ae49b32b7fc510b3e30c29d30675c8a
SHA256

44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65
SHA512

e20e342822c5e7a0905191523511e395ff453f7cda8befb65f618479cdf5141f631c779789f893d7f4cb6891415e528466e6267e59376587bf974c7c71abc02f

Score

10^/10

redline 10fk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

10fk

C2

185.45.192.203:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/636-116-0x0000000004010000-0x000000000402F000-memory.dmp	family_redline
behavioral1/memory/636-119-0x0000000004280000-0x000000000429E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe

pid	process
636	44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe
636	44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe

description pid process

Token: SeDebugPrivilege 636 44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe

description	pid	process
Token: SeDebugPrivilege	636	44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe

C:\Users\Admin\AppData\Local\Temp\44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe
"C:\Users\Admin\AppData\Local\Temp\44b12aa5a47f98a329d796ef7cdb90305ad8ae695c8dc6df4dea49f80668ea65.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-114-0x0000000002400000-0x0000000002430000-memory.dmp

Filesize
192KB

Download
memory/636-115-0x0000000000400000-0x000000000216E000-memory.dmp

Filesize
29.4MB

Download
memory/636-116-0x0000000004010000-0x000000000402F000-memory.dmp

Filesize
124KB

Download
memory/636-117-0x0000000006B70000-0x0000000006B71000-memory.dmp

Filesize
4KB

Download
memory/636-118-0x0000000006B80000-0x0000000006B81000-memory.dmp

Filesize
4KB

Download
memory/636-119-0x0000000004280000-0x000000000429E000-memory.dmp

Filesize
120KB

Download
memory/636-120-0x0000000007080000-0x0000000007081000-memory.dmp

Filesize
4KB

Download
memory/636-121-0x0000000006B72000-0x0000000006B73000-memory.dmp

Filesize
4KB

Download
memory/636-122-0x0000000006B73000-0x0000000006B74000-memory.dmp

Filesize
4KB

Download
memory/636-123-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/636-124-0x0000000006990000-0x0000000006991000-memory.dmp

Filesize
4KB

Download
memory/636-125-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/636-126-0x0000000006B74000-0x0000000006B76000-memory.dmp

Filesize
8KB

Download
memory/636-127-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/636-128-0x0000000008780000-0x0000000008781000-memory.dmp

Filesize
4KB

Download
memory/636-129-0x0000000008950000-0x0000000008951000-memory.dmp

Filesize
4KB

Download
memory/636-130-0x0000000008F70000-0x0000000008F71000-memory.dmp

Filesize
4KB

Download
memory/636-131-0x00000000092D0000-0x00000000092D1000-memory.dmp

Filesize
4KB

Download
memory/636-132-0x0000000009350000-0x0000000009351000-memory.dmp

Filesize
4KB

Download
memory/636-133-0x0000000009540000-0x0000000009541000-memory.dmp

Filesize
4KB

Download
memory/636-134-0x00000000096C0000-0x00000000096C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing