redline | 1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530

General

Target

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
Size

435KB
MD5

e12209fce0519090586f1632f675df56
SHA1

7614e266c04bafca3c5d0eefb46f60fd6901ba1a
SHA256

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530
SHA512

1fcd7c793ca40818dcf38806b6b8e612840261d8e77de8b1fc2f49cf4d0d49a2b0331c3058fbae3f8be65c04f04f1149c34872075cc2c8bce1481801cc176503

Score

10^/10

redline 1823930346 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

1823930346

C2

185.92.74.63:10829

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3832-121-0x0000000000400000-0x0000000000424000-memory.dmp	family_redline
behavioral1/memory/3832-122-0x0000000000418F2A-mapping.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

description	pid	process	target process
PID 2788 set thread context of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

pid process

3832 1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

description pid process

Token: SeDebugPrivilege 3832 1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

pid	process
3832	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

description	pid	process
Token: SeDebugPrivilege	3832	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

description	pid	process	target process
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
PID 2788 wrote to memory of 3832	2788	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe	1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe

C:\Users\Admin\AppData\Local\Temp\1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
"C:\Users\Admin\AppData\Local\Temp\1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788

C:\Users\Admin\AppData\Local\Temp\1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
C:\Users\Admin\AppData\Local\Temp\1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1fe945f3bec81b904912a702ca72a674a01374471653f4faebf61ce326145530.exe.log
MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
memory/2788-115-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2788-117-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/2788-118-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/2788-119-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/2788-120-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/3832-126-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3832-125-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/3832-122-0x0000000000418F2A-mapping.dmp

Download
memory/3832-127-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/3832-128-0x0000000004F40000-0x0000000005546000-memory.dmp

Filesize
6.0MB

Download
memory/3832-129-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3832-130-0x00000000070B0000-0x00000000070B1000-memory.dmp

Filesize
4KB

Download
memory/3832-132-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/3832-134-0x0000000007E70000-0x0000000007E71000-memory.dmp

Filesize
4KB

Download
memory/3832-136-0x0000000007F60000-0x0000000007F61000-memory.dmp

Filesize
4KB

Download
memory/3832-137-0x0000000008C00000-0x0000000008C01000-memory.dmp

Filesize
4KB

Download
memory/3832-138-0x0000000009300000-0x0000000009301000-memory.dmp

Filesize
4KB

Download
memory/3832-121-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads