redline | 35f942f7c250deaf91123ff806ff03769d730ac894ae55b4af5afb1a318a94fb

General

Target

d8f7da9126f80196e3bea63590d9ff19.exe
Size

398KB
MD5

d8f7da9126f80196e3bea63590d9ff19
SHA1

05b218191b034e934aed71a2cf7bb41b4cc60b9c
SHA256

35f942f7c250deaf91123ff806ff03769d730ac894ae55b4af5afb1a318a94fb
SHA512

38d351140d4ec6bb9a0d6462bdd77dddfa7456a35e0227a3e295bf427b07bb6c3ade4008d3c32ee1eb659217ab3c7123857c67fd8709b58f86f7e19f2e28f2de

Score

10^/10

redline 1132044836 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

1132044836

C2

185.183.32.184:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2468-119-0x0000000004AB0000-0x0000000004ADE000-memory.dmp	family_redline
behavioral2/memory/2468-121-0x00000000071E0000-0x000000000720C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d8f7da9126f80196e3bea63590d9ff19.exe

pid process

2468 d8f7da9126f80196e3bea63590d9ff19.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d8f7da9126f80196e3bea63590d9ff19.exe

description pid process

Token: SeDebugPrivilege 2468 d8f7da9126f80196e3bea63590d9ff19.exe

pid	process
2468	d8f7da9126f80196e3bea63590d9ff19.exe

description	pid	process
Token: SeDebugPrivilege	2468	d8f7da9126f80196e3bea63590d9ff19.exe

C:\Users\Admin\AppData\Local\Temp\d8f7da9126f80196e3bea63590d9ff19.exe
"C:\Users\Admin\AppData\Local\Temp\d8f7da9126f80196e3bea63590d9ff19.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-119-0x0000000004AB0000-0x0000000004ADE000-memory.dmp

Filesize
184KB

Download
memory/2468-120-0x00000000072F0000-0x00000000072F1000-memory.dmp

Filesize
4KB

Download
memory/2468-121-0x00000000071E0000-0x000000000720C000-memory.dmp

Filesize
176KB

Download
memory/2468-122-0x0000000004890000-0x00000000048C9000-memory.dmp

Filesize
228KB

Download
memory/2468-124-0x00000000072E0000-0x00000000072E1000-memory.dmp

Filesize
4KB

Download
memory/2468-123-0x0000000000400000-0x0000000002B5C000-memory.dmp

Filesize
39.4MB

Download
memory/2468-125-0x00000000072E2000-0x00000000072E3000-memory.dmp

Filesize
4KB

Download
memory/2468-126-0x00000000072E3000-0x00000000072E4000-memory.dmp

Filesize
4KB

Download
memory/2468-127-0x00000000077F0000-0x00000000077F1000-memory.dmp

Filesize
4KB

Download
memory/2468-128-0x0000000007E00000-0x0000000007E01000-memory.dmp

Filesize
4KB

Download
memory/2468-129-0x0000000007E20000-0x0000000007E21000-memory.dmp

Filesize
4KB

Download
memory/2468-130-0x0000000007F30000-0x0000000007F31000-memory.dmp

Filesize
4KB

Download
memory/2468-131-0x00000000072E4000-0x00000000072E6000-memory.dmp

Filesize
8KB

Download
memory/2468-132-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/2468-133-0x0000000008D40000-0x0000000008D41000-memory.dmp

Filesize
4KB

Download
memory/2468-134-0x0000000008DC0000-0x0000000008DC1000-memory.dmp

Filesize
4KB

Download
memory/2468-135-0x0000000008FD0000-0x0000000008FD1000-memory.dmp

Filesize
4KB

Download
memory/2468-136-0x0000000009080000-0x0000000009081000-memory.dmp

Filesize
4KB

Download
memory/2468-137-0x00000000093A0000-0x00000000093A1000-memory.dmp

Filesize
4KB

Download
memory/2468-138-0x0000000009520000-0x0000000009521000-memory.dmp

Filesize
4KB

Download
memory/2468-139-0x0000000009700000-0x0000000009701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing