redline | 63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab

General

Target

63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe
Size

416KB
MD5

440c6427f359554d5152d93dbb272cc2
SHA1

1be9b53d33272b3730bf564d1f2b39119cfb7c78
SHA256

63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab
SHA512

23e14a24c21a89c0222ab2b6a8ae77be7ff788abfa1b1ed3377723ec49d8b0969e84f26142abe564f2eb20ae6986b70f0ba885af394762bae2e383301fd3c2f8

Score

10^/10

redline teslalogs infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

Teslalogs

C2

91.206.14.151:50125

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/844-119-0x0000000000700000-0x0000000000722000-memory.dmp	family_redline
behavioral1/memory/844-124-0x000000000071C5EA-mapping.dmp	family_redline
behavioral1/memory/844-130-0x0000000004B90000-0x0000000005196000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe

description	pid	process	target process
PID 568 set thread context of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

844 RegSvcs.exe
844 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 844 RegSvcs.exe

pid	process
844	RegSvcs.exe
844	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	844	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe

description	pid	process	target process
PID 568 wrote to memory of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe
PID 568 wrote to memory of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe
PID 568 wrote to memory of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe
PID 568 wrote to memory of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe
PID 568 wrote to memory of 844	568	63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe
"C:\Users\Admin\AppData\Local\Temp\63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/568-115-0x0000000000B10000-0x0000000000B84000-memory.dmp

Filesize
464KB

Download
memory/568-116-0x0000000002E80000-0x0000000002EC3000-memory.dmp

Filesize
268KB

Download
memory/568-117-0x00000000760D0000-0x0000000076292000-memory.dmp

Filesize
1.8MB

Download
memory/568-118-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/844-119-0x0000000000700000-0x0000000000722000-memory.dmp

Filesize
136KB

Download
memory/844-124-0x000000000071C5EA-mapping.dmp

Download
memory/844-125-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/844-127-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/844-128-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/844-129-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/844-130-0x0000000004B90000-0x0000000005196000-memory.dmp

Filesize
6.0MB

Download
memory/844-131-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/844-132-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/844-133-0x0000000006470000-0x0000000006471000-memory.dmp

Filesize
4KB

Download
memory/844-134-0x0000000006B70000-0x0000000006B71000-memory.dmp

Filesize
4KB

Download
memory/844-135-0x00000000070A0000-0x00000000070A1000-memory.dmp

Filesize
4KB

Download
memory/844-136-0x00000000063F0000-0x00000000063F1000-memory.dmp

Filesize
4KB

Download
memory/844-137-0x00000000066E0000-0x00000000066E1000-memory.dmp

Filesize
4KB

Download
memory/844-138-0x00000000066C0000-0x00000000066C1000-memory.dmp

Filesize
4KB

Download
memory/844-139-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/844-140-0x00000000085A0000-0x00000000085A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads