redline | 582c2dda5f1db3872450ce34212515fce0f2201b2d5961d08cdb80556db7c50e

General

Target

4078aa71d541412492dca732e7a4724b.exe
Size

57KB
MD5

4078aa71d541412492dca732e7a4724b
SHA1

c19adcb3808e32b2244eac8dbd5d3b614b09d378
SHA256

582c2dda5f1db3872450ce34212515fce0f2201b2d5961d08cdb80556db7c50e
SHA512

ad4891db2d00efb0341c3793e429fe4b69feb0d4db95f87a3f3793ce0e907a95e3cccf592652eaa299a2a000ae2da34c79850175fcc77a92d912454c23483e7b

Score

10^/10

redline 12102021 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

12102021

C2

185.191.32.196:46757

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1520-123-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/1520-124-0x000000000041B246-mapping.dmp	family_redline
behavioral2/memory/1520-133-0x0000000005590000-0x0000000005B96000-memory.dmp	family_redline

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

4078aa71d541412492dca732e7a4724b.exe

description pid process target process

PID 2160 set thread context of 1520 2160 4078aa71d541412492dca732e7a4724b.exe 4078aa71d541412492dca732e7a4724b.exe

description	pid	process	target process
PID 2160 set thread context of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

4078aa71d541412492dca732e7a4724b.exe4078aa71d541412492dca732e7a4724b.exe

pid	process
2160	4078aa71d541412492dca732e7a4724b.exe
2160	4078aa71d541412492dca732e7a4724b.exe
2160	4078aa71d541412492dca732e7a4724b.exe
2160	4078aa71d541412492dca732e7a4724b.exe
1520	4078aa71d541412492dca732e7a4724b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4078aa71d541412492dca732e7a4724b.exe4078aa71d541412492dca732e7a4724b.exe

description pid process

Token: SeDebugPrivilege 2160 4078aa71d541412492dca732e7a4724b.exe
Token: SeDebugPrivilege 1520 4078aa71d541412492dca732e7a4724b.exe

description	pid	process
Token: SeDebugPrivilege	2160	4078aa71d541412492dca732e7a4724b.exe
Token: SeDebugPrivilege	1520	4078aa71d541412492dca732e7a4724b.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4078aa71d541412492dca732e7a4724b.exe

description	pid	process	target process
PID 2160 wrote to memory of 752	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 752	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 752	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 900	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 900	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 900	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe
PID 2160 wrote to memory of 1520	2160	4078aa71d541412492dca732e7a4724b.exe	4078aa71d541412492dca732e7a4724b.exe

C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe
"C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe
"C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe"
2⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe
"C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe"
2⤵
PID:900

C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe
"C:\Users\Admin\AppData\Local\Temp\4078aa71d541412492dca732e7a4724b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4078aa71d541412492dca732e7a4724b.exe.log
MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
memory/1520-133-0x0000000005590000-0x0000000005B96000-memory.dmp

Filesize
6.0MB

Download
memory/1520-135-0x0000000006E80000-0x0000000006E81000-memory.dmp

Filesize
4KB

Download
memory/1520-129-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/1520-131-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/1520-130-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/1520-141-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/1520-123-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1520-124-0x000000000041B246-mapping.dmp

Download
memory/1520-140-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/1520-128-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/1520-139-0x0000000006A50000-0x0000000006A51000-memory.dmp

Filesize
4KB

Download
memory/1520-136-0x00000000069D0000-0x00000000069D1000-memory.dmp

Filesize
4KB

Download
memory/1520-134-0x0000000006780000-0x0000000006781000-memory.dmp

Filesize
4KB

Download
memory/1520-132-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/2160-115-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/2160-120-0x00000000054E0000-0x00000000059DE000-memory.dmp

Filesize
5.0MB

Download
memory/2160-118-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/2160-121-0x00000000054E0000-0x00000000059DE000-memory.dmp

Filesize
5.0MB

Download
memory/2160-119-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/2160-117-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/2160-122-0x00000000092C0000-0x00000000092CF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads