redline | 16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711

General

Target

16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe
Size

243KB
MD5

3739f03aff1e31de0500ba7f3fc3a1cf
SHA1

9b79f1fd8b9e1dfeccad7959b453f7e58e927e35
SHA256

16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711
SHA512

63dbc24f43ea23fc0526ca4768f9016a037270247ae1f7a97f4b4ad5600b78076d8ccee5e1051d3b8060c1307c16810b6839f8619fcb1d1b002b71d9647fb324

Score

10^/10

redline somebody discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

SomeBody

C2

185.215.113.29:36224

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1552-119-0x0000000002280000-0x000000000229C000-memory.dmp	family_redline
behavioral1/memory/1552-124-0x00000000026A0000-0x00000000026BB000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe

description pid process

Token: SeDebugPrivilege 1552 16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe

description	pid	process
Token: SeDebugPrivilege	1552	16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe

C:\Users\Admin\AppData\Local\Temp\16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe
"C:\Users\Admin\AppData\Local\Temp\16e2a416cd6be40ffeda43ac097c947105562105701734406b10e383f2c88711.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-117-0x00000000021B0000-0x00000000021E0000-memory.dmp

Filesize
192KB

Download
memory/1552-116-0x0000000002180000-0x00000000021A2000-memory.dmp

Filesize
136KB

Download
memory/1552-118-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1552-119-0x0000000002280000-0x000000000229C000-memory.dmp

Filesize
112KB

Download
memory/1552-121-0x0000000004BB2000-0x0000000004BB3000-memory.dmp

Filesize
4KB

Download
memory/1552-120-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/1552-122-0x0000000004BB3000-0x0000000004BB4000-memory.dmp

Filesize
4KB

Download
memory/1552-123-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/1552-124-0x00000000026A0000-0x00000000026BB000-memory.dmp

Filesize
108KB

Download
memory/1552-125-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/1552-126-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/1552-127-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1552-128-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/1552-129-0x0000000004BB4000-0x0000000004BB6000-memory.dmp

Filesize
8KB

Download
memory/1552-130-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/1552-131-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1552-132-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/1552-133-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/1552-134-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download
memory/1552-135-0x0000000006510000-0x0000000006511000-memory.dmp

Filesize
4KB

Download
memory/1552-136-0x0000000006700000-0x0000000006701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing