redline | 059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9

General

Target

059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe
Size

252KB
MD5

f88b6b23fc39e0e445172415bcb4d293
SHA1

13199416888bbb2c7b6c50310848645f8ac12db6
SHA256

059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9
SHA512

64a5b2f83f368875b70e4eaf6b1ea9ea21dedbf15942e4de9f843de3f7350c6c17f847a87da523686c2bb86a1a5bac6999c3e68c2dce58d09b0f910626266ba4

Score

10^/10

redline somebody discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

SomeBody

C2

185.215.113.29:36224

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3480-121-0x00000000021C0000-0x00000000021DC000-memory.dmp	family_redline
behavioral1/memory/3480-123-0x0000000002480000-0x000000000249B000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe

description pid process

Token: SeDebugPrivilege 3480 059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe

description	pid	process
Token: SeDebugPrivilege	3480	059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe

C:\Users\Admin\AppData\Local\Temp\059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe
"C:\Users\Admin\AppData\Local\Temp\059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-118-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download
memory/3480-119-0x00000000006D0000-0x0000000000700000-memory.dmp

Filesize
192KB

Download
memory/3480-120-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3480-121-0x00000000021C0000-0x00000000021DC000-memory.dmp

Filesize
112KB

Download
memory/3480-122-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3480-123-0x0000000002480000-0x000000000249B000-memory.dmp

Filesize
108KB

Download
memory/3480-124-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/3480-125-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3480-126-0x0000000002452000-0x0000000002453000-memory.dmp

Filesize
4KB

Download
memory/3480-127-0x0000000002453000-0x0000000002454000-memory.dmp

Filesize
4KB

Download
memory/3480-128-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3480-129-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/3480-130-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/3480-131-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3480-132-0x0000000002454000-0x0000000002456000-memory.dmp

Filesize
8KB

Download
memory/3480-133-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/3480-134-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/3480-135-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/3480-136-0x0000000005E40000-0x0000000005E41000-memory.dmp

Filesize
4KB

Download
memory/3480-137-0x0000000006540000-0x0000000006541000-memory.dmp

Filesize
4KB

Download
memory/3480-138-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing