redline | 88d8cfc5408b886989697c951a26e10c7ecd605bdebf3a4218dda7053002b926

General

Target

0068f1a9d11db46097fae660005c1228.exe
Size

719KB
MD5

0068f1a9d11db46097fae660005c1228
SHA1

1a7fc24cccaa5bfeae87446a22605a0a475bb409
SHA256

88d8cfc5408b886989697c951a26e10c7ecd605bdebf3a4218dda7053002b926
SHA512

75525095421bf3866e4f465ed2ed89759230248ec08064865b6cf0435c254586960ee8c957a06a16a5c4693bd386338ec7554e820d94045674f172c141938a36

Score

10^/10

redline 1.0.2.0 infostealer

Malware Config

Extracted

Family

redline

Botnet

1.0.2.0

C2

185.183.32.227:51498

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1392-74-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1392-73-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1392-75-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1392-76-0x000000000041B23E-mapping.dmp	family_redline
behavioral1/memory/1392-78-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral1/memory/1004-85-0x0000000002420000-0x000000000306A000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

Madder.exeMadder.exe

pid process

624 Madder.exe
1392 Madder.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exeMadder.exe

pid process

1468 cmd.exe
1468 cmd.exe
624 Madder.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Madder.exe

description pid process target process

PID 624 set thread context of 1392 624 Madder.exe Madder.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1808 powershell.exe
1004 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1808 powershell.exe
Token: SeDebugPrivilege 1004 powershell.exe

pid	process
624	Madder.exe
1392	Madder.exe

pid	process
1468	cmd.exe
1468	cmd.exe
624	Madder.exe

description	pid	process	target process
PID 624 set thread context of 1392	624	Madder.exe	Madder.exe

pid	process
1808	powershell.exe
1004	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

0068f1a9d11db46097fae660005c1228.execmd.execmd.exeMadder.exe

description	pid	process	target process
PID 1604 wrote to memory of 1116	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1116	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1116	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1116	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1468	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1468	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1468	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1604 wrote to memory of 1468	1604	0068f1a9d11db46097fae660005c1228.exe	cmd.exe
PID 1468 wrote to memory of 624	1468	cmd.exe	Madder.exe
PID 1468 wrote to memory of 624	1468	cmd.exe	Madder.exe
PID 1468 wrote to memory of 624	1468	cmd.exe	Madder.exe
PID 1468 wrote to memory of 624	1468	cmd.exe	Madder.exe
PID 1116 wrote to memory of 1808	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1808	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1808	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1808	1116	cmd.exe	powershell.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 624 wrote to memory of 1392	624	Madder.exe	Madder.exe
PID 1116 wrote to memory of 1004	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1004	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1004	1116	cmd.exe	powershell.exe
PID 1116 wrote to memory of 1004	1116	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\0068f1a9d11db46097fae660005c1228.exe
"C:\Users\Admin\AppData\Local\Temp\0068f1a9d11db46097fae660005c1228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Users\Admin\AppData\Local\Temp\Madder.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\Madder.exe
C:\Users\Admin\AppData\Local\Temp\Madder.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\Madder.exe
C:\Users\Admin\AppData\Local\Temp\Madder.exe
4⤵
- Executes dropped EXE
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
1d4e2cdea451859d9ef1ca6ff55571fe

SHA1
85c40ab5054db0ab7b31b9c125eb1468ca548533

SHA256
9fd46ba77a29613a46b23ad1e8da7e742ae34bca6d7fa7e1b61fd841ab7a0ae2

SHA512
0176b820af3e0d3ee828f31fe636d49b72fc3031f4e264a6d6a10553027ba673d6369eef509432f46e2931d326fac3853272db68cea961db67f57df8f822296a

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
\Users\Admin\AppData\Local\Temp\Madder.exe
MD5
b8c0aa13740f17c223af874f41f446d1

SHA1
d2e9a68e012e5d79852f7c64aee1d3dc28fbfe0e

SHA256
ca165fd69131cf44a31bef8e47dbc7b6ba3f08aae5c6f08e0b6a81bc6ae3f35e

SHA512
f65a2f997fdcf2b3b0a2afdf3446c7f825430e9f96343485309a59e35431b7d362b5dcf499c02a9154bacfdc482f01e7c577fa089c6eb760e53011d4ad84bd2e

Download Submit
memory/624-68-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/624-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/624-60-0x0000000000000000-mapping.dmp

Download
memory/1004-84-0x0000000002420000-0x000000000306A000-memory.dmp

Filesize
12.3MB

Download
memory/1004-85-0x0000000002420000-0x000000000306A000-memory.dmp

Filesize
12.3MB

Download
memory/1004-80-0x0000000000000000-mapping.dmp

Download
memory/1004-86-0x0000000002420000-0x000000000306A000-memory.dmp

Filesize
12.3MB

Download
memory/1116-55-0x0000000000000000-mapping.dmp

Download
memory/1392-76-0x000000000041B23E-mapping.dmp

Download
memory/1392-78-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1392-72-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1392-71-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1392-75-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1392-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1392-83-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/1392-73-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1468-56-0x0000000000000000-mapping.dmp

Download
memory/1808-67-0x0000000001FC1000-0x0000000001FC2000-memory.dmp

Filesize
4KB

Download
memory/1808-66-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1808-69-0x0000000001FC2000-0x0000000001FC4000-memory.dmp

Filesize
8KB

Download
memory/1808-63-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1808-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing