redline | 953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959

General

Target

953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe
Size

363KB
MD5

b57cc501b724caf978902696ced96783
SHA1

2c0b229e0606b29c38b30a9d1cdaf960c62ed866
SHA256

953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959
SHA512

7a425975a9d0f622ed950600746634a757598547103c06a2fd0c59dc849d1cc196de00ae18ecf0c56cebef5a587533d4fd0845d651822f1eed8f5df7aa28dce7

Score

10^/10

redline pub discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.182:52236

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3704-117-0x0000000004D30000-0x0000000004D4F000-memory.dmp	family_redline
behavioral1/memory/3704-119-0x0000000007590000-0x00000000075AD000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe

description pid process

Token: SeDebugPrivilege 3704 953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe

description	pid	process
Token: SeDebugPrivilege	3704	953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe

C:\Users\Admin\AppData\Local\Temp\953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe
"C:\Users\Admin\AppData\Local\Temp\953078318579c1e3af47d0f0afa510c5abdb0ee07b9ed97b64d3e48634fc9959.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-116-0x0000000004C60000-0x0000000004C90000-memory.dmp

Filesize
192KB

Download
memory/3704-117-0x0000000004D30000-0x0000000004D4F000-memory.dmp

Filesize
124KB

Download
memory/3704-118-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/3704-119-0x0000000007590000-0x00000000075AD000-memory.dmp

Filesize
116KB

Download
memory/3704-120-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

Filesize
4KB

Download
memory/3704-122-0x00000000076A0000-0x00000000076A1000-memory.dmp

Filesize
4KB

Download
memory/3704-123-0x00000000076A2000-0x00000000076A3000-memory.dmp

Filesize
4KB

Download
memory/3704-121-0x0000000000400000-0x0000000002F23000-memory.dmp

Filesize
43.1MB

Download
memory/3704-124-0x00000000076A3000-0x00000000076A4000-memory.dmp

Filesize
4KB

Download
memory/3704-125-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/3704-126-0x00000000081C0000-0x00000000081C1000-memory.dmp

Filesize
4KB

Download
memory/3704-127-0x00000000082D0000-0x00000000082D1000-memory.dmp

Filesize
4KB

Download
memory/3704-128-0x0000000008320000-0x0000000008321000-memory.dmp

Filesize
4KB

Download
memory/3704-129-0x00000000076A4000-0x00000000076A6000-memory.dmp

Filesize
8KB

Download
memory/3704-130-0x0000000008F40000-0x0000000008F41000-memory.dmp

Filesize
4KB

Download
memory/3704-131-0x0000000009110000-0x0000000009111000-memory.dmp

Filesize
4KB

Download
memory/3704-132-0x0000000009750000-0x0000000009751000-memory.dmp

Filesize
4KB

Download
memory/3704-133-0x0000000009AA0000-0x0000000009AA1000-memory.dmp

Filesize
4KB

Download
memory/3704-134-0x0000000009BB0000-0x0000000009BB1000-memory.dmp

Filesize
4KB

Download
memory/3704-135-0x0000000009C50000-0x0000000009C51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing