redline | 839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8

General

Target

839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe
Size

381KB
MD5

5611023880fc12bf983c349ab34ddc4b
SHA1

4da1c929678f4028a09aa3ee832de82868f117e6
SHA256

839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8
SHA512

4117e65102959aa411c23614c3c8e04633721dfa2e42ac9d12b82f416462580bf30cd8c05bc97d26ec87ac2141c2f2395506e346a69a27805240ad2ef64ebc33

Score

10^/10

redline udp discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4076-118-0x0000000004BC0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4076-122-0x0000000004D80000-0x0000000004D9D000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe

description pid process

Token: SeDebugPrivilege 4076 839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe

description	pid	process
Token: SeDebugPrivilege	4076	839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe

C:\Users\Admin\AppData\Local\Temp\839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe
"C:\Users\Admin\AppData\Local\Temp\839c528efbfc353aa8dc1f51b2a502cf3ba68d1c71ff5b1e6fbc9a490e254ce8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-117-0x0000000000400000-0x0000000002DB7000-memory.dmp

Filesize
41.7MB

Download
memory/4076-116-0x00000000049C0000-0x00000000049F0000-memory.dmp

Filesize
192KB

Download
memory/4076-118-0x0000000004BC0000-0x0000000004BDF000-memory.dmp

Filesize
124KB

Download
memory/4076-120-0x0000000004D32000-0x0000000004D33000-memory.dmp

Filesize
4KB

Download
memory/4076-119-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/4076-121-0x00000000074D0000-0x00000000074D1000-memory.dmp

Filesize
4KB

Download
memory/4076-122-0x0000000004D80000-0x0000000004D9D000-memory.dmp

Filesize
116KB

Download
memory/4076-123-0x00000000079D0000-0x00000000079D1000-memory.dmp

Filesize
4KB

Download
memory/4076-124-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4076-125-0x00000000080F0000-0x00000000080F1000-memory.dmp

Filesize
4KB

Download
memory/4076-126-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/4076-128-0x0000000004D34000-0x0000000004D36000-memory.dmp

Filesize
8KB

Download
memory/4076-127-0x0000000004D33000-0x0000000004D34000-memory.dmp

Filesize
4KB

Download
memory/4076-129-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4076-130-0x0000000008C90000-0x0000000008C91000-memory.dmp

Filesize
4KB

Download
memory/4076-131-0x0000000008E60000-0x0000000008E61000-memory.dmp

Filesize
4KB

Download
memory/4076-132-0x0000000009490000-0x0000000009491000-memory.dmp

Filesize
4KB

Download
memory/4076-133-0x00000000097F0000-0x00000000097F1000-memory.dmp

Filesize
4KB

Download
memory/4076-134-0x00000000098F0000-0x00000000098F1000-memory.dmp

Filesize
4KB

Download
memory/4076-135-0x0000000009AA0000-0x0000000009AA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing