redline | fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e

General

Target

fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe
Size

570KB
MD5

d96bdb26efa2d431ce5f054e81771d5f
SHA1

308d3427887954e2adc04e5e7326c9ca8107c3a7
SHA256

fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e
SHA512

248c4f5e4651d9c3f24fc4aa9f04108d7d8c6bf928914014ea37b756b76bfb62eab4b39354d906827852f848c8d884b3c8dc153054867e1fd3109d1c4df315cc

Score

10^/10

redline mix15.09 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

mix15.09

C2

185.215.113.15:6043

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4656-120-0x0000000000A20000-0x0000000000A3F000-memory.dmp	family_redline
behavioral1/memory/4656-122-0x0000000002370000-0x000000000238E000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

apinesp.exe

pid process

4656 apinesp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
4656	apinesp.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

apinesp.exe

pid process

4656 apinesp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

apinesp.exe

description pid process

Token: SeDebugPrivilege 4656 apinesp.exe

pid	process
4656	apinesp.exe

description	pid	process
Token: SeDebugPrivilege	4656	apinesp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe

description	pid	process	target process
PID 4564 wrote to memory of 4656	4564	fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe	apinesp.exe
PID 4564 wrote to memory of 4656	4564	fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe	apinesp.exe
PID 4564 wrote to memory of 4656	4564	fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe	apinesp.exe

C:\Users\Admin\AppData\Local\Temp\fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe
"C:\Users\Admin\AppData\Local\Temp\fca06c8d2fff93f7f8b0e272954cc99f363c32fe8169e95bb06d885e3697615e.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Roaming\wushup\apinesp.exe
apinesp.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wushup\apinesp.exe
MD5
56ce9f55182e2d0a68fc3a5d914695a9

SHA1
688b1677fd782f9754be46ed6595b5552892a361

SHA256
1f92fcdfb40475f95f044971dbf32a4617d5d02b790a0d6e86b58724783f2eee

SHA512
bd952aa8272b20772f9435f4c20455b07815c193cfc3b7a6c3aa805f0386186f7440bd08a3efe0cedf1252fc5f95697e7100fa3639c47d6c540efcdae071fbb7

Download Submit
C:\Users\Admin\AppData\Roaming\wushup\apinesp.exe
MD5
56ce9f55182e2d0a68fc3a5d914695a9

SHA1
688b1677fd782f9754be46ed6595b5552892a361

SHA256
1f92fcdfb40475f95f044971dbf32a4617d5d02b790a0d6e86b58724783f2eee

SHA512
bd952aa8272b20772f9435f4c20455b07815c193cfc3b7a6c3aa805f0386186f7440bd08a3efe0cedf1252fc5f95697e7100fa3639c47d6c540efcdae071fbb7

Download Submit
memory/4564-116-0x0000000000400000-0x00000000021AD000-memory.dmp

Filesize
29.7MB

Download
memory/4564-115-0x0000000002400000-0x00000000024CC000-memory.dmp

Filesize
816KB

Download
memory/4656-127-0x0000000000470000-0x00000000005BA000-memory.dmp

Filesize
1.3MB

Download
memory/4656-128-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4656-121-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/4656-122-0x0000000002370000-0x000000000238E000-memory.dmp

Filesize
120KB

Download
memory/4656-123-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/4656-124-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/4656-125-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/4656-126-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/4656-117-0x0000000000000000-mapping.dmp

Download
memory/4656-129-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/4656-130-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/4656-120-0x0000000000A20000-0x0000000000A3F000-memory.dmp

Filesize
124KB

Download
memory/4656-131-0x0000000000A12000-0x0000000000A13000-memory.dmp

Filesize
4KB

Download
memory/4656-132-0x0000000000A13000-0x0000000000A14000-memory.dmp

Filesize
4KB

Download
memory/4656-133-0x0000000000A14000-0x0000000000A16000-memory.dmp

Filesize
8KB

Download
memory/4656-134-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download
memory/4656-135-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/4656-136-0x0000000007130000-0x0000000007131000-memory.dmp

Filesize
4KB

Download
memory/4656-137-0x0000000007250000-0x0000000007251000-memory.dmp

Filesize
4KB

Download
memory/4656-138-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/4656-139-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads