redline | ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb

General

Target

ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe
Size

390KB
MD5

9337232f31140e5dafbe332ade813800
SHA1

496231944f348e6ccb37c92074d35784bf1d1053
SHA256

ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb
SHA512

4d87e48da40ead3154e0c6a16c946f125ecba3a153cf65f72044d0f51d73169e43b39065973b139282270f14c9d57b18c866212741dc919e97c82acc263d7d98

Score

10^/10

redline paladin discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

paladin

C2

37.228.129.48:29795

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2344-116-0x00000000038C0000-0x00000000038EF000-memory.dmp	family_redline
behavioral1/memory/2344-123-0x0000000005DA0000-0x0000000005DCE000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe

pid process

2344 ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe

description pid process

Token: SeDebugPrivilege 2344 ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe

pid	process
2344	ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe

description	pid	process
Token: SeDebugPrivilege	2344	ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe

C:\Users\Admin\AppData\Local\Temp\ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe
"C:\Users\Admin\AppData\Local\Temp\ca7731eecfce2a331dac132bc922fb348bde95306685ed94feb61345f07f10eb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-115-0x00000000018B9000-0x00000000018E1000-memory.dmp

Filesize
160KB

Download
memory/2344-116-0x00000000038C0000-0x00000000038EF000-memory.dmp

Filesize
188KB

Download
memory/2344-117-0x0000000005F00000-0x0000000005F01000-memory.dmp

Filesize
4KB

Download
memory/2344-119-0x0000000000400000-0x00000000016D4000-memory.dmp

Filesize
18.8MB

Download
memory/2344-118-0x0000000001780000-0x00000000018CA000-memory.dmp

Filesize
1.3MB

Download
memory/2344-121-0x0000000005EF2000-0x0000000005EF3000-memory.dmp

Filesize
4KB

Download
memory/2344-122-0x0000000005EF3000-0x0000000005EF4000-memory.dmp

Filesize
4KB

Download
memory/2344-120-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/2344-123-0x0000000005DA0000-0x0000000005DCE000-memory.dmp

Filesize
184KB

Download
memory/2344-124-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download
memory/2344-125-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/2344-126-0x0000000006A10000-0x0000000006A11000-memory.dmp

Filesize
4KB

Download
memory/2344-127-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/2344-128-0x0000000006B20000-0x0000000006B21000-memory.dmp

Filesize
4KB

Download
memory/2344-129-0x0000000005EF4000-0x0000000005EF6000-memory.dmp

Filesize
8KB

Download
memory/2344-130-0x0000000007730000-0x0000000007731000-memory.dmp

Filesize
4KB

Download
memory/2344-131-0x0000000007900000-0x0000000007901000-memory.dmp

Filesize
4KB

Download
memory/2344-132-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/2344-133-0x0000000008290000-0x0000000008291000-memory.dmp

Filesize
4KB

Download
memory/2344-134-0x00000000083A0000-0x00000000083A1000-memory.dmp

Filesize
4KB

Download
memory/2344-135-0x0000000008440000-0x0000000008441000-memory.dmp

Filesize
4KB

Download
memory/2344-136-0x0000000008620000-0x0000000008621000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing