redline | 65ac41a575bef9b2c3bccc5699bdd6962e4bc7b30618ac876a880e3528c50493

General

Target

Loader.exe
Size

1.1MB
MD5

35ef1da481434536d768ea3d38afd4c6
SHA1

55681185303670a382514f649c0c26e1aeadc53b
SHA256

65ac41a575bef9b2c3bccc5699bdd6962e4bc7b30618ac876a880e3528c50493
SHA512

e136c3aa9a679ee554eae6e5899cdfadecf0fecf0d94c5c8cd245f3abb3e77dcb7935bd3e3791220e690aa137b1558b35d03772d12dc95848ba7fc6b3b045fe1

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1416-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1416-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1416-65-0x0000000000418D56-mapping.dmp	family_redline
behavioral1/memory/1416-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1416-66-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

Loader.exe

description pid process target process

PID 572 set thread context of 1416 572 Loader.exe Loader.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Loader.exe

pid process

1416 Loader.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Loader.exeLoader.exe

description pid process

Token: SeDebugPrivilege 572 Loader.exe
Token: SeDebugPrivilege 1416 Loader.exe

description	pid	process	target process
PID 572 set thread context of 1416	572	Loader.exe	Loader.exe

pid	process
1416	Loader.exe

description	pid	process
Token: SeDebugPrivilege	572	Loader.exe
Token: SeDebugPrivilege	1416	Loader.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Loader.exe

description	pid	process	target process
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe
PID 572 wrote to memory of 1416	572	Loader.exe	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-54-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/572-56-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/572-57-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/572-58-0x00000000047D5000-0x00000000047E6000-memory.dmp

Filesize
68KB

Download
memory/572-59-0x0000000008A90000-0x0000000008B87000-memory.dmp

Filesize
988KB

Download
memory/1416-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-65-0x0000000000418D56-mapping.dmp

Download
memory/1416-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-68-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing