redline | 2f802aab0b83ba927a253910e4fb2a071f39c5515d08e29be2c2a687771be0d5

General

Target

1d7c16cf49e3cbafa8ffb3872b17792b.exe
Size

16KB
MD5

1d7c16cf49e3cbafa8ffb3872b17792b
SHA1

164149a2298e3ae54ac91cde92e88b88cea1f5f5
SHA256

2f802aab0b83ba927a253910e4fb2a071f39c5515d08e29be2c2a687771be0d5
SHA512

3dab9da577095a2008d0d3947b80d5719c74df5c4b7e48a9aad63c3843e1b0930298dcbf03a1b32c6eae9da7e43749401d2edfcb80949b28c3262fb1e3811df5

Score

10^/10

redline @alan_miller102 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@alan_miller102

C2

194.15.46.144:36848

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Stub.exe	family_redline
C:\ProgramData\Stub.exe	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

Stub.exe

pid process

2716 Stub.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Stub.exe

pid process

2716 Stub.exe
2716 Stub.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1d7c16cf49e3cbafa8ffb3872b17792b.exeStub.exe

description pid process

Token: SeDebugPrivilege 2372 1d7c16cf49e3cbafa8ffb3872b17792b.exe
Token: SeDebugPrivilege 2716 Stub.exe

pid	process
2716	Stub.exe

pid	process
2716	Stub.exe
2716	Stub.exe

description	pid	process
Token: SeDebugPrivilege	2372	1d7c16cf49e3cbafa8ffb3872b17792b.exe
Token: SeDebugPrivilege	2716	Stub.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1d7c16cf49e3cbafa8ffb3872b17792b.exe

description	pid	process	target process
PID 2372 wrote to memory of 2716	2372	1d7c16cf49e3cbafa8ffb3872b17792b.exe	Stub.exe
PID 2372 wrote to memory of 2716	2372	1d7c16cf49e3cbafa8ffb3872b17792b.exe	Stub.exe
PID 2372 wrote to memory of 2716	2372	1d7c16cf49e3cbafa8ffb3872b17792b.exe	Stub.exe

C:\Users\Admin\AppData\Local\Temp\1d7c16cf49e3cbafa8ffb3872b17792b.exe
"C:\Users\Admin\AppData\Local\Temp\1d7c16cf49e3cbafa8ffb3872b17792b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372

C:\ProgramData\Stub.exe
"C:\ProgramData\Stub.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Stub.exe
MD5
96dce028459cf26be5816b14c6b14484

SHA1
e0a93d63ebc7e56459005d911edece66987531dd

SHA256
e7d036c77c92bcc5773be4c2f4b4476282f36c0c05f45ab5b3bf2d275270cf06

SHA512
d37089834b5c662eebb9f7efce8fd61a62018ded5c45d5405e72dab5e844744f548980ec6265e184c82ff52505fa3189c195c5f8ea62a70260b9ab986ae2188e

Download Submit
C:\ProgramData\Stub.exe
MD5
96dce028459cf26be5816b14c6b14484

SHA1
e0a93d63ebc7e56459005d911edece66987531dd

SHA256
e7d036c77c92bcc5773be4c2f4b4476282f36c0c05f45ab5b3bf2d275270cf06

SHA512
d37089834b5c662eebb9f7efce8fd61a62018ded5c45d5405e72dab5e844744f548980ec6265e184c82ff52505fa3189c195c5f8ea62a70260b9ab986ae2188e

Download Submit
memory/2372-117-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/2372-115-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2716-127-0x00000000052E0000-0x00000000058E6000-memory.dmp

Filesize
6.0MB

Download
memory/2716-128-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/2716-123-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/2716-124-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/2716-125-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/2716-126-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/2716-118-0x0000000000000000-mapping.dmp

Download
memory/2716-121-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2716-129-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/2716-130-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/2716-131-0x0000000007090000-0x0000000007091000-memory.dmp

Filesize
4KB

Download
memory/2716-132-0x0000000007110000-0x0000000007111000-memory.dmp

Filesize
4KB

Download
memory/2716-133-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/2716-134-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/2716-135-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/2716-136-0x0000000008680000-0x0000000008681000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing