redline | 75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c

General

Target

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
Size

5.9MB
MD5

24d7b3e065cb0570a44a101641acd8b4
SHA1

7f71838113850cf07bebfe1da7a9211a7119a579
SHA256

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c
SHA512

a7b9258d1e65f95461bbbb70169d29697c33e9ef348f850a76d866d9163f6e657275267a7b11f0a4032b3471d47095c471b0a22a7b9aacb432e912138cc40bbf

Score

10^/10

redline 444 infostealer spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4396-127-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/4396-132-0x0000000000419322-mapping.dmp	family_redline

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/3504-123-0x0000000000A60000-0x0000000001511000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe

pid process

3504 75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe

description	pid	process	target process
PID 3504 set thread context of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exeRegSvcs.exe

pid	process
3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
4396	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4396 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4396	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe

description	pid	process	target process
PID 3504 wrote to memory of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe
PID 3504 wrote to memory of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe
PID 3504 wrote to memory of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe
PID 3504 wrote to memory of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe
PID 3504 wrote to memory of 4396	3504	75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe
"C:\Users\Admin\AppData\Local\Temp\75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3504-115-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3504-116-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/3504-117-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3504-118-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download
memory/3504-119-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/3504-120-0x0000000001590000-0x0000000001591000-memory.dmp

Filesize
4KB

Download
memory/3504-122-0x00000000015B0000-0x00000000015B1000-memory.dmp

Filesize
4KB

Download
memory/3504-123-0x0000000000A60000-0x0000000001511000-memory.dmp

Filesize
10.7MB

Download
memory/3504-126-0x00000000015A0000-0x00000000015A1000-memory.dmp

Filesize
4KB

Download
memory/4396-127-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4396-132-0x0000000000419322-mapping.dmp

Download
memory/4396-133-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/4396-135-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/4396-136-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/4396-137-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/4396-138-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/4396-139-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/4396-140-0x0000000005240000-0x0000000005846000-memory.dmp

Filesize
6.0MB

Download
memory/4396-141-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/4396-142-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/4396-143-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download
memory/4396-144-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/4396-145-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/4396-146-0x0000000006CD0000-0x0000000006CD1000-memory.dmp

Filesize
4KB

Download
memory/4396-147-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/4396-148-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads