redline | 2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0

General

Target

2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe
Size

423KB
MD5

c93d53e3c2084e714928cf4f68b269b6
SHA1

5f854b3d5d5321100a807868bee20006b92bb7e6
SHA256

2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0
SHA512

07ab4f100cdb4fcf4037cf545f8aa62ff12675f7331e2a8841cfd69fa6213e6f63760d946bc52432072e540b76f74b48d06a825ba159a1fb45afe68c04fa02f1

Score

10^/10

redline updbdate discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Updbdate

C2

193.56.146.64:65441

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2576-121-0x0000000005120000-0x000000000514E000-memory.dmp	family_redline
behavioral1/memory/2576-126-0x0000000005320000-0x000000000534C000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe

description pid process

Token: SeDebugPrivilege 2576 2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe

description	pid	process
Token: SeDebugPrivilege	2576	2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe

C:\Users\Admin\AppData\Local\Temp\2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe
"C:\Users\Admin\AppData\Local\Temp\2f039d178ce4087caa42c396630e80008884b15fdeb56901fe16b44c4b4a88d0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-119-0x00000000032F0000-0x000000000339E000-memory.dmp

Filesize
696KB

Download
memory/2576-120-0x0000000000400000-0x0000000003245000-memory.dmp

Filesize
46.3MB

Download
memory/2576-121-0x0000000005120000-0x000000000514E000-memory.dmp

Filesize
184KB

Download
memory/2576-122-0x0000000007A90000-0x0000000007A91000-memory.dmp

Filesize
4KB

Download
memory/2576-124-0x0000000007A82000-0x0000000007A83000-memory.dmp

Filesize
4KB

Download
memory/2576-123-0x0000000007A80000-0x0000000007A81000-memory.dmp

Filesize
4KB

Download
memory/2576-125-0x0000000007A83000-0x0000000007A84000-memory.dmp

Filesize
4KB

Download
memory/2576-126-0x0000000005320000-0x000000000534C000-memory.dmp

Filesize
176KB

Download
memory/2576-127-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/2576-128-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/2576-129-0x00000000085A0000-0x00000000085A1000-memory.dmp

Filesize
4KB

Download
memory/2576-130-0x00000000079E0000-0x00000000079E1000-memory.dmp

Filesize
4KB

Download
memory/2576-131-0x0000000007A84000-0x0000000007A86000-memory.dmp

Filesize
8KB

Download
memory/2576-132-0x00000000087B0000-0x00000000087B1000-memory.dmp

Filesize
4KB

Download
memory/2576-133-0x0000000008930000-0x0000000008931000-memory.dmp

Filesize
4KB

Download
memory/2576-134-0x0000000008A30000-0x0000000008A31000-memory.dmp

Filesize
4KB

Download
memory/2576-135-0x00000000089F0000-0x00000000089F1000-memory.dmp

Filesize
4KB

Download
memory/2576-136-0x0000000008B10000-0x0000000008B11000-memory.dmp

Filesize
4KB

Download
memory/2576-137-0x0000000009350000-0x0000000009351000-memory.dmp

Filesize
4KB

Download
memory/2576-138-0x0000000009560000-0x0000000009561000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing