redline | 5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea

General

Target

5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe
Size

393KB
MD5

80ba347d1d5540a5cbaaf2f16c7e56da
SHA1

bff14e4f4d960b4ca4e11fbc6f41cf0e27a5f7de
SHA256

5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea
SHA512

dae0b776669e9e0b40b0847bc6ad3338611113ff644a130c1e4a6c194c5a144f7736642c4d0c6a73a1f68e60f34c550835a7177891d1258d70f6fb5438b62d72

Score

10^/10

redline pubdate discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Pubdate

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-121-0x0000000003BB0000-0x0000000003BDE000-memory.dmp	family_redline
behavioral1/memory/1912-123-0x0000000003F50000-0x0000000003F7C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe

description pid process

Token: SeDebugPrivilege 1912 5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe

description	pid	process
Token: SeDebugPrivilege	1912	5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe

C:\Users\Admin\AppData\Local\Temp\5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe
"C:\Users\Admin\AppData\Local\Temp\5354060136626cd16635bdf8310f7f2ee752ae92915eade742cbe9c01aa4adea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-118-0x0000000001D56000-0x0000000001D82000-memory.dmp

Filesize
176KB

Download
memory/1912-119-0x0000000001CB0000-0x0000000001D5E000-memory.dmp

Filesize
696KB

Download
memory/1912-120-0x0000000000400000-0x0000000001C18000-memory.dmp

Filesize
24.1MB

Download
memory/1912-121-0x0000000003BB0000-0x0000000003BDE000-memory.dmp

Filesize
184KB

Download
memory/1912-122-0x0000000006420000-0x0000000006421000-memory.dmp

Filesize
4KB

Download
memory/1912-123-0x0000000003F50000-0x0000000003F7C000-memory.dmp

Filesize
176KB

Download
memory/1912-124-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/1912-126-0x0000000003FE3000-0x0000000003FE4000-memory.dmp

Filesize
4KB

Download
memory/1912-125-0x0000000003FE2000-0x0000000003FE3000-memory.dmp

Filesize
4KB

Download
memory/1912-127-0x0000000006920000-0x0000000006921000-memory.dmp

Filesize
4KB

Download
memory/1912-128-0x0000000004050000-0x0000000004051000-memory.dmp

Filesize
4KB

Download
memory/1912-129-0x0000000006F30000-0x0000000006F31000-memory.dmp

Filesize
4KB

Download
memory/1912-130-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download
memory/1912-131-0x0000000007080000-0x0000000007081000-memory.dmp

Filesize
4KB

Download
memory/1912-132-0x0000000003FE4000-0x0000000003FE6000-memory.dmp

Filesize
8KB

Download
memory/1912-133-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/1912-134-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/1912-135-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/1912-136-0x0000000007630000-0x0000000007631000-memory.dmp

Filesize
4KB

Download
memory/1912-137-0x0000000007E80000-0x0000000007E81000-memory.dmp

Filesize
4KB

Download
memory/1912-138-0x0000000008050000-0x0000000008051000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing