redline | 2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5

General

Target

2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe
Size

423KB
MD5

bb28cd3e6d277d7e1a1f5a211554f8b0
SHA1

5ed1b519ac2bc44abc49a4514b1f23808469afeb
SHA256

2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5
SHA512

9d42a3088b747cf891fd3dddb8e0b2c321ac9abe477d5d847779a8d113ec206d6f7d0c0e73797226f9d5e65c0b2a0f27a9330fd1519fc6a88cda0f79640c5c05

Score

10^/10

redline updbdate discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Updbdate

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3684-120-0x0000000007850000-0x000000000787E000-memory.dmp	family_redline
behavioral1/memory/3684-122-0x0000000007E00000-0x0000000007E2C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe

description pid process

Token: SeDebugPrivilege 3684 2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe

description	pid	process
Token: SeDebugPrivilege	3684	2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe

C:\Users\Admin\AppData\Local\Temp\2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe
"C:\Users\Admin\AppData\Local\Temp\2acfdc710d1c679fd6dc470bc520bf4cbecb5990463cb44a2d32c06a960a44f5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-118-0x0000000003526000-0x0000000003552000-memory.dmp

Filesize
176KB

Download
memory/3684-119-0x00000000033B0000-0x00000000033E9000-memory.dmp

Filesize
228KB

Download
memory/3684-120-0x0000000007850000-0x000000000787E000-memory.dmp

Filesize
184KB

Download
memory/3684-121-0x0000000007900000-0x0000000007901000-memory.dmp

Filesize
4KB

Download
memory/3684-122-0x0000000007E00000-0x0000000007E2C000-memory.dmp

Filesize
176KB

Download
memory/3684-123-0x0000000007E30000-0x0000000007E31000-memory.dmp

Filesize
4KB

Download
memory/3684-124-0x00000000084D0000-0x00000000084D1000-memory.dmp

Filesize
4KB

Download
memory/3684-125-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/3684-126-0x0000000000400000-0x0000000003245000-memory.dmp

Filesize
46.3MB

Download
memory/3684-127-0x00000000078F0000-0x00000000078F1000-memory.dmp

Filesize
4KB

Download
memory/3684-128-0x00000000078F2000-0x00000000078F3000-memory.dmp

Filesize
4KB

Download
memory/3684-129-0x00000000078F3000-0x00000000078F4000-memory.dmp

Filesize
4KB

Download
memory/3684-130-0x00000000078F4000-0x00000000078F6000-memory.dmp

Filesize
8KB

Download
memory/3684-131-0x0000000008610000-0x0000000008611000-memory.dmp

Filesize
4KB

Download
memory/3684-132-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/3684-133-0x0000000008930000-0x0000000008931000-memory.dmp

Filesize
4KB

Download
memory/3684-134-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

Filesize
4KB

Download
memory/3684-135-0x00000000090C0000-0x00000000090C1000-memory.dmp

Filesize
4KB

Download
memory/3684-136-0x00000000092A0000-0x00000000092A1000-memory.dmp

Filesize
4KB

Download
memory/3684-137-0x00000000093C0000-0x00000000093C1000-memory.dmp

Filesize
4KB

Download
memory/3684-138-0x0000000009590000-0x0000000009591000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing