redline | 486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e

General

Target

486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe
Size

243KB
MD5

9f53f50a74bfac5ac8b77ef4306cce31
SHA1

9c3b13800f15cdaa74d3f2227ed720f3f47f8d6f
SHA256

486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e
SHA512

e524a9fc4bc0528e02ae07439b2e794fc2840f5e3f3a18aa125d00aacc294b0c9715020ba3a78eb4db4c05fcdc3d2ee4a20848f24645f07d8bcb35155fd1dbb9

Score

10^/10

redline somebody discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

SomeBody

C2

185.215.113.29:36224

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4092-120-0x00000000023D0000-0x00000000023EC000-memory.dmp	family_redline
behavioral1/memory/4092-122-0x0000000002670000-0x000000000268B000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe

description pid process

Token: SeDebugPrivilege 4092 486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe

description	pid	process
Token: SeDebugPrivilege	4092	486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe

C:\Users\Admin\AppData\Local\Temp\486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe
"C:\Users\Admin\AppData\Local\Temp\486a3e5bfce8918586e3c4bf1d1c2ea92f07d657022a68c520d6bfbc7f76f14e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4092-117-0x00000000021B0000-0x00000000021E0000-memory.dmp

Filesize
192KB

Download
memory/4092-116-0x0000000002160000-0x0000000002182000-memory.dmp

Filesize
136KB

Download
memory/4092-118-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4092-119-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/4092-120-0x00000000023D0000-0x00000000023EC000-memory.dmp

Filesize
112KB

Download
memory/4092-121-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/4092-122-0x0000000002670000-0x000000000268B000-memory.dmp

Filesize
108KB

Download
memory/4092-123-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/4092-124-0x0000000004D52000-0x0000000004D53000-memory.dmp

Filesize
4KB

Download
memory/4092-125-0x0000000004D53000-0x0000000004D54000-memory.dmp

Filesize
4KB

Download
memory/4092-126-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/4092-127-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/4092-128-0x0000000004D54000-0x0000000004D56000-memory.dmp

Filesize
8KB

Download
memory/4092-129-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/4092-130-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/4092-131-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/4092-132-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/4092-133-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/4092-134-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/4092-135-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/4092-136-0x0000000006700000-0x0000000006701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing