redline | ba60a173e1935175aaddd6a07759577fa82f0b47f2ae978e6d27f0185ec6e560

General

Target

b00091e0d18e7337ce5dfd2694505857.exe
Size

441KB
MD5

b00091e0d18e7337ce5dfd2694505857
SHA1

a04b9b77e5d0750994ed3cfabd9cf0e495773f02
SHA256

ba60a173e1935175aaddd6a07759577fa82f0b47f2ae978e6d27f0185ec6e560
SHA512

be5a1637af6dd608d374b00816702da0a3b24a564854a2ef2a7602e5cd2e13bff47d591c62431457f7c87f229dd9d9de3a29fa7d6e1906adf80f27ea08565e81

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3748-118-0x0000000002730000-0x000000000275D000-memory.dmp	family_redline
behavioral2/memory/3748-121-0x0000000002A80000-0x0000000002AAB000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b00091e0d18e7337ce5dfd2694505857.exe

pid process

3748 b00091e0d18e7337ce5dfd2694505857.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b00091e0d18e7337ce5dfd2694505857.exe

description pid process

Token: SeDebugPrivilege 3748 b00091e0d18e7337ce5dfd2694505857.exe

pid	process
3748	b00091e0d18e7337ce5dfd2694505857.exe

description	pid	process
Token: SeDebugPrivilege	3748	b00091e0d18e7337ce5dfd2694505857.exe

C:\Users\Admin\AppData\Local\Temp\b00091e0d18e7337ce5dfd2694505857.exe
"C:\Users\Admin\AppData\Local\Temp\b00091e0d18e7337ce5dfd2694505857.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3748-115-0x0000000000A95000-0x0000000000AC1000-memory.dmp

Filesize
176KB

Download
memory/3748-116-0x0000000000930000-0x0000000000A7A000-memory.dmp

Filesize
1.3MB

Download
memory/3748-117-0x0000000000400000-0x000000000089D000-memory.dmp

Filesize
4.6MB

Download
memory/3748-118-0x0000000002730000-0x000000000275D000-memory.dmp

Filesize
180KB

Download
memory/3748-119-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/3748-120-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/3748-121-0x0000000002A80000-0x0000000002AAB000-memory.dmp

Filesize
172KB

Download
memory/3748-122-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/3748-123-0x00000000050B2000-0x00000000050B3000-memory.dmp

Filesize
4KB

Download
memory/3748-125-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/3748-124-0x00000000050B3000-0x00000000050B4000-memory.dmp

Filesize
4KB

Download
memory/3748-126-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Filesize
4KB

Download
memory/3748-127-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/3748-128-0x00000000050B4000-0x00000000050B6000-memory.dmp

Filesize
8KB

Download
memory/3748-129-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/3748-130-0x0000000005F60000-0x0000000005F61000-memory.dmp

Filesize
4KB

Download
memory/3748-131-0x0000000006650000-0x0000000006651000-memory.dmp

Filesize
4KB

Download
memory/3748-132-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/3748-133-0x0000000006710000-0x0000000006711000-memory.dmp

Filesize
4KB

Download
memory/3748-134-0x00000000069B0000-0x00000000069B1000-memory.dmp

Filesize
4KB

Download
memory/3748-135-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/3748-136-0x0000000006A00000-0x0000000006A01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing