redline | e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea

General

Target

e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe
Size

369KB
MD5

c4fdab0de4e035cf383208e30ef433c8
SHA1

de5a068ff2406039539c20661631bd68decdc814
SHA256

e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea
SHA512

9141c469811e8a76d4ceee5ce063e60a655e8bb4445dc0c2a7562ed86141456d99611d1e531dee8ea2deed8135e555d6f3c9fa7276256bc348f0d2b34b7f6358

Score

10^/10

redline pub discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2072-117-0x0000000003410000-0x000000000342F000-memory.dmp	family_redline
behavioral1/memory/2072-119-0x00000000038D0000-0x00000000038ED000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe

description pid process

Token: SeDebugPrivilege 2072 e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe

description	pid	process
Token: SeDebugPrivilege	2072	e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe

C:\Users\Admin\AppData\Local\Temp\e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe
"C:\Users\Admin\AppData\Local\Temp\e60dc758c46b5011adb77dd1cd032e563068a47b268b483421d515583ae2e8ea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-116-0x00000000032B0000-0x00000000032E0000-memory.dmp

Filesize
192KB

Download
memory/2072-117-0x0000000003410000-0x000000000342F000-memory.dmp

Filesize
124KB

Download
memory/2072-118-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download
memory/2072-119-0x00000000038D0000-0x00000000038ED000-memory.dmp

Filesize
116KB

Download
memory/2072-120-0x00000000064C0000-0x00000000064C1000-memory.dmp

Filesize
4KB

Download
memory/2072-121-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download
memory/2072-122-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/2072-123-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

Filesize
4KB

Download
memory/2072-124-0x0000000000400000-0x00000000016CF000-memory.dmp

Filesize
18.8MB

Download
memory/2072-126-0x0000000005FB2000-0x0000000005FB3000-memory.dmp

Filesize
4KB

Download
memory/2072-127-0x0000000005FB3000-0x0000000005FB4000-memory.dmp

Filesize
4KB

Download
memory/2072-125-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/2072-128-0x0000000005FB4000-0x0000000005FB6000-memory.dmp

Filesize
8KB

Download
memory/2072-129-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

Filesize
4KB

Download
memory/2072-130-0x00000000076E0000-0x00000000076E1000-memory.dmp

Filesize
4KB

Download
memory/2072-131-0x00000000078B0000-0x00000000078B1000-memory.dmp

Filesize
4KB

Download
memory/2072-132-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Filesize
4KB

Download
memory/2072-133-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/2072-134-0x00000000080B0000-0x00000000080B1000-memory.dmp

Filesize
4KB

Download
memory/2072-135-0x0000000008230000-0x0000000008231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing