redline | 488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3

General

Target

488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe
Size

411KB
MD5

18290b488551427d043e207c16fc41e7
SHA1

e73935b75f978a4fec25f60edb49cc025ada4a65
SHA256

488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3
SHA512

694373fb6397ba4c86238f4d8efa36fe6dfee3233bff228c49f0ac722aa08c8d1c386f267b78c7730843c1ca483749c94d79022a909a73a91b93f4ead92de860

Score

10^/10

redline somebody discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

SomeBody

C2

185.215.113.29:36224

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2076-121-0x00000000028F0000-0x000000000290C000-memory.dmp	family_redline
behavioral1/memory/2076-123-0x0000000004F70000-0x0000000004F8B000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe

description pid process

Token: SeDebugPrivilege 2076 488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe

description	pid	process
Token: SeDebugPrivilege	2076	488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe

C:\Users\Admin\AppData\Local\Temp\488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe
"C:\Users\Admin\AppData\Local\Temp\488dedd3ee899dc27dcd19436efdeaa4ea0c6145fbf99ff93bc3971649e78fd3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-118-0x0000000000CE9000-0x0000000000D0B000-memory.dmp

Filesize
136KB

Download
memory/2076-119-0x0000000000C90000-0x0000000000CC0000-memory.dmp

Filesize
192KB

Download
memory/2076-120-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2076-121-0x00000000028F0000-0x000000000290C000-memory.dmp

Filesize
112KB

Download
memory/2076-122-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/2076-123-0x0000000004F70000-0x0000000004F8B000-memory.dmp

Filesize
108KB

Download
memory/2076-124-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/2076-125-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/2076-126-0x0000000005B70000-0x0000000005B71000-memory.dmp

Filesize
4KB

Download
memory/2076-127-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/2076-128-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/2076-130-0x0000000005042000-0x0000000005043000-memory.dmp

Filesize
4KB

Download
memory/2076-129-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2076-131-0x0000000005043000-0x0000000005044000-memory.dmp

Filesize
4KB

Download
memory/2076-132-0x0000000005044000-0x0000000005046000-memory.dmp

Filesize
8KB

Download
memory/2076-133-0x0000000005E90000-0x0000000005E91000-memory.dmp

Filesize
4KB

Download
memory/2076-134-0x0000000006680000-0x0000000006681000-memory.dmp

Filesize
4KB

Download
memory/2076-135-0x0000000006780000-0x0000000006781000-memory.dmp

Filesize
4KB

Download
memory/2076-136-0x0000000006740000-0x0000000006741000-memory.dmp

Filesize
4KB

Download
memory/2076-137-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download
memory/2076-138-0x0000000006BC0000-0x0000000006BC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing