redline | 945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c

General

Target

945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe
Size

364KB
MD5

42fa2e971b1f93642c66e19f39c5205e
SHA1

eb62b43f7dfc24f72d4555cab3eee59dc9b9fa90
SHA256

945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c
SHA512

f50a266b7bd85df973561e3a318b6dab6238f5092754b7a320d79a8c2d7a52ded0e134f16ac576c738a694e52c24509c1eda049330235e71c29c7057771767d7

Score

10^/10

redline pub discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3572-118-0x0000000004C70000-0x0000000004C8F000-memory.dmp	family_redline
behavioral1/memory/3572-120-0x0000000004E30000-0x0000000004E4D000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe

description pid process

Token: SeDebugPrivilege 3572 945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe

description	pid	process
Token: SeDebugPrivilege	3572	945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe

C:\Users\Admin\AppData\Local\Temp\945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe
"C:\Users\Admin\AppData\Local\Temp\945fe3c3c626d8ecaae983a6a10190ac83e2d5e1bdbde22813fdef0edecdc33c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3572-115-0x0000000003139000-0x000000000315C000-memory.dmp

Filesize
140KB

Download
memory/3572-117-0x0000000000400000-0x0000000002F23000-memory.dmp

Filesize
43.1MB

Download
memory/3572-116-0x0000000002F30000-0x000000000307A000-memory.dmp

Filesize
1.3MB

Download
memory/3572-118-0x0000000004C70000-0x0000000004C8F000-memory.dmp

Filesize
124KB

Download
memory/3572-119-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/3572-120-0x0000000004E30000-0x0000000004E4D000-memory.dmp

Filesize
116KB

Download
memory/3572-121-0x0000000007A40000-0x0000000007A41000-memory.dmp

Filesize
4KB

Download
memory/3572-122-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/3572-123-0x0000000008050000-0x0000000008051000-memory.dmp

Filesize
4KB

Download
memory/3572-124-0x0000000008160000-0x0000000008161000-memory.dmp

Filesize
4KB

Download
memory/3572-125-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/3572-126-0x0000000004C42000-0x0000000004C43000-memory.dmp

Filesize
4KB

Download
memory/3572-127-0x0000000004C43000-0x0000000004C44000-memory.dmp

Filesize
4KB

Download
memory/3572-128-0x0000000004C44000-0x0000000004C46000-memory.dmp

Filesize
8KB

Download
memory/3572-129-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/3572-130-0x0000000008E00000-0x0000000008E01000-memory.dmp

Filesize
4KB

Download
memory/3572-131-0x0000000008FD0000-0x0000000008FD1000-memory.dmp

Filesize
4KB

Download
memory/3572-132-0x0000000009600000-0x0000000009601000-memory.dmp

Filesize
4KB

Download
memory/3572-133-0x0000000009710000-0x0000000009711000-memory.dmp

Filesize
4KB

Download
memory/3572-134-0x00000000098F0000-0x00000000098F1000-memory.dmp

Filesize
4KB

Download
memory/3572-135-0x0000000009950000-0x0000000009951000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing