redline | ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf

General

Target

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
Size

765KB
MD5

2be66ce2b5cfdfec51cdc633577f0cb4
SHA1

baf35c5c0fc89199e61010d2d52013c2d67cc6c6
SHA256

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf
SHA512

8e75844260c6b353feffb5b524e21f8373f6bdf3eefe1fdbb6e201fb8331de63be3256150118f340f9c6eba0b06c495e3e3589afb67a82743449fa28ecf7484a

Score

10^/10

redline 3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

3

C2

116.203.27.211:4803

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3680-128-0x000000000041C67A-mapping.dmp	family_redline
behavioral1/memory/3680-127-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/3680-139-0x0000000005150000-0x000000000564E000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

description	pid	process	target process
PID 2484 set thread context of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

pid	process
3680	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
3680	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

description pid process

Token: SeDebugPrivilege 3680 ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

description	pid	process
Token: SeDebugPrivilege	3680	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

description	pid	process	target process
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
PID 2484 wrote to memory of 3680	2484	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe	ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe

C:\Users\Admin\AppData\Local\Temp\ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
"C:\Users\Admin\AppData\Local\Temp\ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe
"C:\Users\Admin\AppData\Local\Temp\ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf.exe.log
MD5
b4f7a6a57cb46d94b72410eb6a6d45a9

SHA1
69f3596ffa027202d391444b769ceea0ae14c5f7

SHA256
23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

SHA512
be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

Download Submit
memory/2484-115-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/2484-117-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/2484-118-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/2484-119-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2484-120-0x0000000005840000-0x00000000058AA000-memory.dmp

Filesize
424KB

Download
memory/2484-121-0x00000000058B0000-0x0000000005919000-memory.dmp

Filesize
420KB

Download
memory/2484-122-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/2484-123-0x0000000005BF0000-0x0000000005BF7000-memory.dmp

Filesize
28KB

Download
memory/2484-124-0x0000000008E70000-0x0000000008E71000-memory.dmp

Filesize
4KB

Download
memory/2484-125-0x0000000009330000-0x000000000939A000-memory.dmp

Filesize
424KB

Download
memory/2484-126-0x000000000BB10000-0x000000000BB58000-memory.dmp

Filesize
288KB

Download
memory/3680-127-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3680-139-0x0000000005150000-0x000000000564E000-memory.dmp

Filesize
5.0MB

Download
memory/3680-133-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/3680-135-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/3680-136-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/3680-137-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/3680-138-0x0000000006060000-0x0000000006061000-memory.dmp

Filesize
4KB

Download
memory/3680-128-0x000000000041C67A-mapping.dmp

Download
memory/3680-140-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/3680-141-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Filesize
4KB

Download
memory/3680-142-0x0000000008740000-0x0000000008741000-memory.dmp

Filesize
4KB

Download
memory/3680-143-0x0000000008A10000-0x0000000008A11000-memory.dmp

Filesize
4KB

Download
memory/3680-144-0x0000000008C90000-0x0000000008C91000-memory.dmp

Filesize
4KB

Download
memory/3680-145-0x0000000009800000-0x0000000009801000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads