redline | 8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a

General

Target

8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe
Size

402KB
MD5

b635809fb0a1cf794429559aba6b9fed
SHA1

413c5c263dd07df563928b2c760b959c7b266a82
SHA256

8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a
SHA512

af3ff5d139b39e65a2d479e7401b086fedcbad96308a71ea188a31e9f12476d01f638f031b7d1448a2ed983780f3a74680a696af033fc585fc42faaa104f3f6a

Score

10^/10

redline updbdate discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Updbdate

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3776-119-0x0000000003CB0000-0x0000000003CDE000-memory.dmp	family_redline
behavioral1/memory/3776-126-0x0000000003E60000-0x0000000003E8C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe

description pid process

Token: SeDebugPrivilege 3776 8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe

description	pid	process
Token: SeDebugPrivilege	3776	8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe

C:\Users\Admin\AppData\Local\Temp\8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe
"C:\Users\Admin\AppData\Local\Temp\8f8f1ed7bc641b2a7cb1f28e765999ed247cc1c855537b87f5cf00358866487a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3776-118-0x0000000001ED9000-0x0000000001F05000-memory.dmp

Filesize
176KB

Download
memory/3776-119-0x0000000003CB0000-0x0000000003CDE000-memory.dmp

Filesize
184KB

Download
memory/3776-120-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download
memory/3776-122-0x0000000000400000-0x0000000001C1A000-memory.dmp

Filesize
24.1MB

Download
memory/3776-121-0x0000000003960000-0x0000000003999000-memory.dmp

Filesize
228KB

Download
memory/3776-124-0x0000000003EC2000-0x0000000003EC3000-memory.dmp

Filesize
4KB

Download
memory/3776-123-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Filesize
4KB

Download
memory/3776-125-0x0000000003EC3000-0x0000000003EC4000-memory.dmp

Filesize
4KB

Download
memory/3776-126-0x0000000003E60000-0x0000000003E8C000-memory.dmp

Filesize
176KB

Download
memory/3776-127-0x0000000006830000-0x0000000006831000-memory.dmp

Filesize
4KB

Download
memory/3776-128-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

Filesize
4KB

Download
memory/3776-129-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Filesize
4KB

Download
memory/3776-130-0x0000000006FE0000-0x0000000006FE1000-memory.dmp

Filesize
4KB

Download
memory/3776-131-0x0000000007070000-0x0000000007071000-memory.dmp

Filesize
4KB

Download
memory/3776-132-0x0000000003EC4000-0x0000000003EC6000-memory.dmp

Filesize
8KB

Download
memory/3776-133-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/3776-134-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/3776-135-0x0000000007A90000-0x0000000007A91000-memory.dmp

Filesize
4KB

Download
memory/3776-136-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/3776-137-0x0000000007D90000-0x0000000007D91000-memory.dmp

Filesize
4KB

Download
memory/3776-138-0x0000000007F60000-0x0000000007F61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing