redline | 58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10

General

Target

58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe
Size

404KB
MD5

321a79a8f02fc5edb9f7d9820a7a9908
SHA1

fadcf7b810f5660fd695de49dd66868a4cebbd19
SHA256

58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10
SHA512

63f8f70f3c53a1423664342666927ee6370724c526bc37e726d6aa6c6edfd94890ee0d029f18d87a0c3ded90876c6238fddde5032de9f1d0823fe4a23fe419e8

Score

10^/10

redline ruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

RUZKI

C2

185.215.113.29:26828

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-121-0x0000000003C40000-0x0000000003C6E000-memory.dmp	family_redline
behavioral1/memory/2228-123-0x0000000003DE0000-0x0000000003E0C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe

description pid process

Token: SeDebugPrivilege 2228 58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe

description	pid	process
Token: SeDebugPrivilege	2228	58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe

C:\Users\Admin\AppData\Local\Temp\58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe
"C:\Users\Admin\AppData\Local\Temp\58af05687c427abf79f665c75b199d24a5a3a0976ece82d6479015d14eb0bb10.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-118-0x0000000001D19000-0x0000000001D45000-memory.dmp

Filesize
176KB

Download
memory/2228-119-0x0000000003970000-0x00000000039A9000-memory.dmp

Filesize
228KB

Download
memory/2228-120-0x0000000000400000-0x0000000001C1B000-memory.dmp

Filesize
24.1MB

Download
memory/2228-121-0x0000000003C40000-0x0000000003C6E000-memory.dmp

Filesize
184KB

Download
memory/2228-122-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download
memory/2228-123-0x0000000003DE0000-0x0000000003E0C000-memory.dmp

Filesize
176KB

Download
memory/2228-124-0x0000000006450000-0x0000000006451000-memory.dmp

Filesize
4KB

Download
memory/2228-125-0x0000000006452000-0x0000000006453000-memory.dmp

Filesize
4KB

Download
memory/2228-126-0x0000000006453000-0x0000000006454000-memory.dmp

Filesize
4KB

Download
memory/2228-127-0x0000000006F70000-0x0000000006F71000-memory.dmp

Filesize
4KB

Download
memory/2228-128-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/2228-129-0x0000000006960000-0x0000000006961000-memory.dmp

Filesize
4KB

Download
memory/2228-130-0x00000000063E0000-0x00000000063E1000-memory.dmp

Filesize
4KB

Download
memory/2228-131-0x0000000006454000-0x0000000006456000-memory.dmp

Filesize
8KB

Download
memory/2228-132-0x0000000006A70000-0x0000000006A71000-memory.dmp

Filesize
4KB

Download
memory/2228-133-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/2228-134-0x0000000006E00000-0x0000000006E01000-memory.dmp

Filesize
4KB

Download
memory/2228-135-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/2228-136-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/2228-137-0x0000000007D30000-0x0000000007D31000-memory.dmp

Filesize
4KB

Download
memory/2228-138-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing