redline | c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096

General

Target

1110626324.exe
Size

1.3MB
MD5

1330be0f9459506cfd3d972082f3cb0e
SHA1

116815a43e5d9c6ae9dc998e93948e274209711a
SHA256

c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096
SHA512

0d865e09ca6ab65f617ad43d7badfbd80db79354e73178555ea2a37d9a51f40db94f7ff3c791b00da8ff84c91397a761d03b06ddac787f162b8edc23eabda1bc

Score

10^/10

redline new1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

new1

C2

185.180.220.105:11915

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2104-119-0x0000000000400000-0x0000000000456000-memory.dmp	family_redline
behavioral2/memory/2104-124-0x000000000041C5F2-mapping.dmp	family_redline
behavioral2/memory/2104-132-0x00000000051F0000-0x00000000056EE000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

foto.exe

pid process

3932 foto.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

foto.exe

description pid process target process

PID 3932 set thread context of 2104 3932 foto.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2104 RegSvcs.exe
2104 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2104 RegSvcs.exe

pid	process
3932	foto.exe

description	pid	process	target process
PID 3932 set thread context of 2104	3932	foto.exe	RegSvcs.exe

pid	process
2104	RegSvcs.exe
2104	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2104	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1110626324.exefoto.exe

description	pid	process	target process
PID 668 wrote to memory of 3932	668	1110626324.exe	foto.exe
PID 668 wrote to memory of 3932	668	1110626324.exe	foto.exe
PID 668 wrote to memory of 3932	668	1110626324.exe	foto.exe
PID 3932 wrote to memory of 2104	3932	foto.exe	RegSvcs.exe
PID 3932 wrote to memory of 2104	3932	foto.exe	RegSvcs.exe
PID 3932 wrote to memory of 2104	3932	foto.exe	RegSvcs.exe
PID 3932 wrote to memory of 2104	3932	foto.exe	RegSvcs.exe
PID 3932 wrote to memory of 2104	3932	foto.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\1110626324.exe
"C:\Users\Admin\AppData\Local\Temp\1110626324.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\foto.exe
MD5
4da64a00d7ff89c04d675f50c32ee458

SHA1
505f39f4039bf5cba0009ea7b7d856f57d31a592

SHA256
610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

SHA512
d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Download Submit
memory/2104-129-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/2104-130-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/2104-124-0x000000000041C5F2-mapping.dmp

Download
memory/2104-125-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2104-127-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2104-128-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/2104-138-0x0000000009310000-0x0000000009311000-memory.dmp

Filesize
4KB

Download
memory/2104-119-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2104-131-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/2104-132-0x00000000051F0000-0x00000000056EE000-memory.dmp

Filesize
5.0MB

Download
memory/2104-133-0x0000000005F80000-0x0000000005F81000-memory.dmp

Filesize
4KB

Download
memory/2104-134-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/2104-135-0x0000000008630000-0x0000000008631000-memory.dmp

Filesize
4KB

Download
memory/2104-136-0x0000000008820000-0x0000000008821000-memory.dmp

Filesize
4KB

Download
memory/2104-137-0x0000000008A00000-0x0000000008A01000-memory.dmp

Filesize
4KB

Download
memory/3932-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing