redline | 939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6

General

Target

939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe
Size

423KB
MD5

33932848e089f432a87c4f1174865fbc
SHA1

556f154b6392789770c03bb0b9b36b697de80d46
SHA256

939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6
SHA512

dd3c89e8ea12b3cfc4e68482d5338111e709e2c8bc41c5fdfb5a915abc5a66dc3893a6219cfff08c81b23c8866cb769c053edcb298ce32ef4ba08f799965320b

Score

10^/10

redline udptest discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

udptest

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3620-121-0x00000000052A0000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3620-123-0x0000000005470000-0x000000000549C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe

description pid process

Token: SeDebugPrivilege 3620 939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe

description	pid	process
Token: SeDebugPrivilege	3620	939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe

C:\Users\Admin\AppData\Local\Temp\939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe
"C:\Users\Admin\AppData\Local\Temp\939b334d4dd234bead3eaf476b3f70d58a50babc48dd678a6e109eca2f4fcca6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3620-120-0x0000000000400000-0x0000000003245000-memory.dmp

Filesize
46.3MB

Download
memory/3620-119-0x0000000003390000-0x00000000034DA000-memory.dmp

Filesize
1.3MB

Download
memory/3620-121-0x00000000052A0000-0x00000000052CE000-memory.dmp

Filesize
184KB

Download
memory/3620-122-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/3620-123-0x0000000005470000-0x000000000549C000-memory.dmp

Filesize
176KB

Download
memory/3620-124-0x0000000008160000-0x0000000008161000-memory.dmp

Filesize
4KB

Download
memory/3620-126-0x0000000007C52000-0x0000000007C53000-memory.dmp

Filesize
4KB

Download
memory/3620-125-0x0000000007C50000-0x0000000007C51000-memory.dmp

Filesize
4KB

Download
memory/3620-127-0x0000000007C53000-0x0000000007C54000-memory.dmp

Filesize
4KB

Download
memory/3620-128-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3620-129-0x0000000007A60000-0x0000000007A61000-memory.dmp

Filesize
4KB

Download
memory/3620-130-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/3620-131-0x0000000007C54000-0x0000000007C56000-memory.dmp

Filesize
8KB

Download
memory/3620-132-0x0000000007B90000-0x0000000007B91000-memory.dmp

Filesize
4KB

Download
memory/3620-133-0x0000000008940000-0x0000000008941000-memory.dmp

Filesize
4KB

Download
memory/3620-134-0x0000000009030000-0x0000000009031000-memory.dmp

Filesize
4KB

Download
memory/3620-135-0x00000000090D0000-0x00000000090D1000-memory.dmp

Filesize
4KB

Download
memory/3620-136-0x00000000092D0000-0x00000000092D1000-memory.dmp

Filesize
4KB

Download
memory/3620-137-0x00000000093D0000-0x00000000093D1000-memory.dmp

Filesize
4KB

Download
memory/3620-138-0x00000000095A0000-0x00000000095A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing