redline | 70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5

General

Target

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
Size

5.9MB
MD5

e60167411a3a1f4f125b5f17ab07f064
SHA1

18a5d27a9bf4e6d21a6c4cff57911c2376ad42e7
SHA256

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5
SHA512

6393876ad657e67a484c2461a9ecba1cbea57c9e4a39567302525f49560ceac643d11b7444fa5d6fa47333bde1db10373f3ccd289504ad97f78a26658ecdb95c

Score

10^/10

redline 444 infostealer spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/668-126-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/668-131-0x000000000041932A-mapping.dmp	family_redline
behavioral1/memory/668-139-0x0000000004F00000-0x0000000005506000-memory.dmp	family_redline

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/3792-122-0x0000000000A70000-0x0000000001526000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe

pid process

3792 70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe

description	pid	process	target process
PID 3792 set thread context of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exeRegSvcs.exe

pid	process
3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
668	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 668 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	668	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe

description	pid	process	target process
PID 3792 wrote to memory of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe
PID 3792 wrote to memory of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe
PID 3792 wrote to memory of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe
PID 3792 wrote to memory of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe
PID 3792 wrote to memory of 668	3792	70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe
"C:\Users\Admin\AppData\Local\Temp\70123500558ce2dcee6ee1d14f138ecdbf3a7f743c71680b8fca5a254d7dcac5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-139-0x0000000004F00000-0x0000000005506000-memory.dmp

Filesize
6.0MB

Download
memory/668-140-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/668-132-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/668-134-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/668-146-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/668-145-0x00000000076A0000-0x00000000076A1000-memory.dmp

Filesize
4KB

Download
memory/668-144-0x0000000006120000-0x0000000006121000-memory.dmp

Filesize
4KB

Download
memory/668-143-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/668-135-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/668-141-0x0000000005E20000-0x0000000005E21000-memory.dmp

Filesize
4KB

Download
memory/668-126-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/668-131-0x000000000041932A-mapping.dmp

Download
memory/668-138-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/668-147-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/668-142-0x0000000005F80000-0x0000000005F81000-memory.dmp

Filesize
4KB

Download
memory/668-136-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/668-137-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3792-116-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3792-114-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3792-115-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/3792-125-0x0000000000560000-0x00000000006AA000-memory.dmp

Filesize
1.3MB

Download
memory/3792-122-0x0000000000A70000-0x0000000001526000-memory.dmp

Filesize
10.7MB

Download
memory/3792-121-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3792-120-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3792-119-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3792-118-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3792-117-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads