redline | 5709a8b2658fa9ccf9137f164dae6094d997c0cc42e87cb84f9e6e86087b07ef

Analysis

max time kernel
110s
max time network
62s
platform
windows7_x64
resource
win7v20210408
submitted
26-09-2021 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolanumsYoghurt_2021-09-26_14-52.exe
Size

274KB
MD5

105284f4061d970957c38814ed96eec6
SHA1

a6a0adb7f986be857be7520da0b498c975b0d845
SHA256

5709a8b2658fa9ccf9137f164dae6094d997c0cc42e87cb84f9e6e86087b07ef
SHA512

771e64a374320d57f0b0f98272dd3dc657546494bb881efa5984ce4e0cf14c2f9b1aef8a1e269099c80dc9705d5af9f457519d2231150305206848a7d52658a7

Score

10^/10

redline bliss discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Bliss

185.237.98.178:62607

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1932-60-0x0000000002020000-0x0000000002043000-memory.dmp	family_redline
behavioral1/memory/1932-66-0x0000000002050000-0x0000000002072000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SolanumsYoghurt_2021-09-26_14-52.exe

pid process

1932 SolanumsYoghurt_2021-09-26_14-52.exe
1932 SolanumsYoghurt_2021-09-26_14-52.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SolanumsYoghurt_2021-09-26_14-52.exe

description pid process

Token: SeDebugPrivilege 1932 SolanumsYoghurt_2021-09-26_14-52.exe

pid	process
1932	SolanumsYoghurt_2021-09-26_14-52.exe
1932	SolanumsYoghurt_2021-09-26_14-52.exe

description	pid	process
Token: SeDebugPrivilege	1932	SolanumsYoghurt_2021-09-26_14-52.exe

C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-60-0x0000000002020000-0x0000000002043000-memory.dmp

Filesize
140KB

Download
memory/1932-61-0x00000000002D0000-0x0000000000307000-memory.dmp

Filesize
220KB

Download
memory/1932-63-0x0000000004B91000-0x0000000004B92000-memory.dmp

Filesize
4KB

Download
memory/1932-64-0x0000000004B92000-0x0000000004B93000-memory.dmp

Filesize
4KB

Download
memory/1932-65-0x0000000004B93000-0x0000000004B94000-memory.dmp

Filesize
4KB

Download
memory/1932-66-0x0000000002050000-0x0000000002072000-memory.dmp

Filesize
136KB

Download
memory/1932-62-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1932-67-0x0000000004B94000-0x0000000004B96000-memory.dmp

Filesize
8KB

Download