redline | 4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993

General

Target

4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe
Size

337KB
MD5

281a18ac516786123a4adafa4f933a54
SHA1

a115555a4f83f98e017bf07b40f7552b0027649a
SHA256

4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993
SHA512

f0f8df4009fd41282a035ee9c3a406459b0c17c456866b5e67588190b3ce4ddf7540eda3586ac334967fa4f1cb19e599cdf5bdf1a0b0ff2a0282d3d019c0896e

Score

10^/10

redline udp discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1688-115-0x0000000005000000-0x000000000501F000-memory.dmp	family_redline
behavioral1/memory/1688-117-0x0000000005070000-0x000000000508D000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe

description pid process

Token: SeDebugPrivilege 1688 4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe

description	pid	process
Token: SeDebugPrivilege	1688	4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe

C:\Users\Admin\AppData\Local\Temp\4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe
"C:\Users\Admin\AppData\Local\Temp\4987bb01ce72f3f71870c04598412da9038d602b2fe655033d32b1d7061fd993.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-115-0x0000000005000000-0x000000000501F000-memory.dmp

Filesize
124KB

Download
memory/1688-116-0x00000000077B0000-0x00000000077B1000-memory.dmp

Filesize
4KB

Download
memory/1688-117-0x0000000005070000-0x000000000508D000-memory.dmp

Filesize
116KB

Download
memory/1688-118-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/1688-119-0x0000000004B30000-0x0000000004B53000-memory.dmp

Filesize
140KB

Download
memory/1688-121-0x0000000004B60000-0x0000000004B90000-memory.dmp

Filesize
192KB

Download
memory/1688-122-0x0000000000400000-0x0000000002F1B000-memory.dmp

Filesize
43.1MB

Download
memory/1688-120-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/1688-123-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/1688-125-0x00000000053E3000-0x00000000053E4000-memory.dmp

Filesize
4KB

Download
memory/1688-124-0x00000000053E2000-0x00000000053E3000-memory.dmp

Filesize
4KB

Download
memory/1688-126-0x00000000082C0000-0x00000000082C1000-memory.dmp

Filesize
4KB

Download
memory/1688-127-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/1688-128-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1688-129-0x00000000053E4000-0x00000000053E6000-memory.dmp

Filesize
8KB

Download
memory/1688-130-0x0000000008F60000-0x0000000008F61000-memory.dmp

Filesize
4KB

Download
memory/1688-131-0x0000000009130000-0x0000000009131000-memory.dmp

Filesize
4KB

Download
memory/1688-132-0x0000000009760000-0x0000000009761000-memory.dmp

Filesize
4KB

Download
memory/1688-133-0x0000000009AC0000-0x0000000009AC1000-memory.dmp

Filesize
4KB

Download
memory/1688-134-0x0000000009BC0000-0x0000000009BC1000-memory.dmp

Filesize
4KB

Download
memory/1688-135-0x0000000009D80000-0x0000000009D81000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing