redline | 2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a

General

Target

2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe
Size

296KB
MD5

235b56fb26d7ef2f0bfce5b521a0b99c
SHA1

d5deb3e56423a6865c543636dad0e4ef756eaa15
SHA256

2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a
SHA512

1eb2a2968f7052311cf67c35d863847e5fda213c6ab827e3aa76ff23dcf8cc31c609feae45a0a446f064182bc44938f4407681a77c9a40a67ba87c4d11b11609

Score

10^/10

redline pubdate discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Pubdate

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3952-118-0x00000000024B0000-0x00000000024DE000-memory.dmp	family_redline
behavioral1/memory/3952-123-0x00000000026C0000-0x00000000026EC000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe

description pid process

Token: SeDebugPrivilege 3952 2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe

description	pid	process
Token: SeDebugPrivilege	3952	2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe

C:\Users\Admin\AppData\Local\Temp\2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe
"C:\Users\Admin\AppData\Local\Temp\2d090a2cf40c2b82288160ecce78416c10343100b21434a3bfc7b6167747682a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-116-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3952-115-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3952-117-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3952-118-0x00000000024B0000-0x00000000024DE000-memory.dmp

Filesize
184KB

Download
memory/3952-119-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/3952-120-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/3952-121-0x0000000004E62000-0x0000000004E63000-memory.dmp

Filesize
4KB

Download
memory/3952-122-0x0000000004E63000-0x0000000004E64000-memory.dmp

Filesize
4KB

Download
memory/3952-123-0x00000000026C0000-0x00000000026EC000-memory.dmp

Filesize
176KB

Download
memory/3952-124-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/3952-125-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/3952-126-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3952-127-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/3952-128-0x0000000004E64000-0x0000000004E66000-memory.dmp

Filesize
8KB

Download
memory/3952-129-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/3952-130-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/3952-131-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/3952-132-0x0000000005C40000-0x0000000005C41000-memory.dmp

Filesize
4KB

Download
memory/3952-133-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/3952-134-0x0000000007840000-0x0000000007841000-memory.dmp

Filesize
4KB

Download
memory/3952-135-0x0000000007A20000-0x0000000007A21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing