redline | 2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d

General

Target

2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe
Size

395KB
MD5

47e27edcb9be738259f5c3d81423c613
SHA1

3974b52edd4a1b1dedc6c2dcb308f735e444c131
SHA256

2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d
SHA512

7144947aa0f4be257e444e6e2bf61797b6dcdfd2390a46a5ceec17530d4f3b8e8139e3648d63aad35bc3d81e39b98a4fe2e12597d927e5144e1e3e05e0d42a58

Score

10^/10

redline 3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

3

C2

45.147.228.207:1569

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4640-116-0x00000000037F0000-0x000000000380F000-memory.dmp	family_redline
behavioral1/memory/4640-122-0x00000000038A0000-0x00000000038BE000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe

pid process

4640 2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe

description pid process

Token: SeDebugPrivilege 4640 2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe

pid	process
4640	2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe

description	pid	process
Token: SeDebugPrivilege	4640	2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe

C:\Users\Admin\AppData\Local\Temp\2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe
"C:\Users\Admin\AppData\Local\Temp\2a103ceb37522c1bb5f9b6336e52c3c8341b15276bbc44149ac65d26375b4c1d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-115-0x00000000034D0000-0x0000000003500000-memory.dmp

Filesize
192KB

Download
memory/4640-116-0x00000000037F0000-0x000000000380F000-memory.dmp

Filesize
124KB

Download
memory/4640-117-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/4640-119-0x0000000003840000-0x0000000003841000-memory.dmp

Filesize
4KB

Download
memory/4640-118-0x0000000000400000-0x000000000179A000-memory.dmp

Filesize
19.6MB

Download
memory/4640-120-0x0000000003842000-0x0000000003843000-memory.dmp

Filesize
4KB

Download
memory/4640-121-0x0000000003843000-0x0000000003844000-memory.dmp

Filesize
4KB

Download
memory/4640-122-0x00000000038A0000-0x00000000038BE000-memory.dmp

Filesize
120KB

Download
memory/4640-123-0x0000000006530000-0x0000000006531000-memory.dmp

Filesize
4KB

Download
memory/4640-124-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/4640-125-0x0000000006B40000-0x0000000006B41000-memory.dmp

Filesize
4KB

Download
memory/4640-126-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/4640-127-0x0000000003844000-0x0000000003846000-memory.dmp

Filesize
8KB

Download
memory/4640-128-0x0000000003A20000-0x0000000003A21000-memory.dmp

Filesize
4KB

Download
memory/4640-129-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/4640-130-0x0000000007F80000-0x0000000007F81000-memory.dmp

Filesize
4KB

Download
memory/4640-131-0x00000000085A0000-0x00000000085A1000-memory.dmp

Filesize
4KB

Download
memory/4640-132-0x0000000008930000-0x0000000008931000-memory.dmp

Filesize
4KB

Download
memory/4640-133-0x0000000008A30000-0x0000000008A31000-memory.dmp

Filesize
4KB

Download
memory/4640-134-0x0000000008A00000-0x0000000008A01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing