redline | 6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a7296f0f250d20d00cbc69

General

Target

6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
Size

927KB
MD5

950c6b87e1bb3df00a70c46575e55c24
SHA1

794737f9d40f2239eff492525b603efed0de0177
SHA256

6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a7296f0f250d20d00cbc69
SHA512

aba4addbc9b0211afd1f8fd439546a288e8f017419b8998033603a83731a5a56b1ffea726733d614ae59aa03f26ca8380de2c503a39563d2afe47aa0fe999e75

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4372-115-0x0000000000740000-0x000000000076E000-memory.dmp	family_redline
behavioral2/memory/4372-119-0x00000000008B0000-0x00000000008C9000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe

pid process

4372 6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe

description pid process

Token: SeDebugPrivilege 4372 6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe

pid	process
4372	6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe

description	pid	process
Token: SeDebugPrivilege	4372	6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe

C:\Users\Admin\AppData\Local\Temp\6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
"C:\Users\Admin\AppData\Local\Temp\6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4372-115-0x0000000000740000-0x000000000076E000-memory.dmp

Filesize
184KB

Download
memory/4372-119-0x00000000008B0000-0x00000000008C9000-memory.dmp

Filesize
100KB

Download
memory/4372-121-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/4372-122-0x0000000005392000-0x0000000005393000-memory.dmp

Filesize
4KB

Download
memory/4372-123-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/4372-124-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/4372-125-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/4372-126-0x0000000005393000-0x0000000005394000-memory.dmp

Filesize
4KB

Download
memory/4372-127-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/4372-128-0x0000000005394000-0x0000000005395000-memory.dmp

Filesize
4KB

Download
memory/4372-129-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/4372-130-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/4372-131-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/4372-132-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/4372-133-0x0000000006370000-0x0000000006371000-memory.dmp

Filesize
4KB

Download
memory/4372-134-0x0000000006930000-0x0000000006931000-memory.dmp

Filesize
4KB

Download
memory/4372-135-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/4372-136-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/4372-137-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing