redline | d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83

General

Target

d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe
Size

387KB
MD5

45a80d4856ec35f2c0827e0800a92587
SHA1

e230b4a479cfa95df334ec3d02d07bac8c1157eb
SHA256

d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83
SHA512

3a9a3731aa916258779e1d27638e63fde6f47500bd09b00c73cbda8fea4855ca0043f0b48bcd9527377541b3ded23140f4d2a33399ac8ba258326709d71e1522

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2340-118-0x0000000002410000-0x0000000002444000-memory.dmp	family_redline
behavioral1/memory/2340-120-0x0000000002770000-0x00000000027A2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe

description pid process

Token: SeDebugPrivilege 2340 d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe

description	pid	process
Token: SeDebugPrivilege	2340	d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe

C:\Users\Admin\AppData\Local\Temp\d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe
"C:\Users\Admin\AppData\Local\Temp\d27b2b8bc6f9e95d5ebec82083ec8952f33daf2b7ab4fc0ce9812e265fa0df83.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-116-0x0000000002330000-0x0000000002369000-memory.dmp

Filesize
228KB

Download
memory/2340-117-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download
memory/2340-118-0x0000000002410000-0x0000000002444000-memory.dmp

Filesize
208KB

Download
memory/2340-119-0x0000000004EC0000-0x00000000053BE000-memory.dmp

Filesize
5.0MB

Download
memory/2340-120-0x0000000002770000-0x00000000027A2000-memory.dmp

Filesize
200KB

Download
memory/2340-121-0x00000000053C0000-0x00000000059C6000-memory.dmp

Filesize
6.0MB

Download
memory/2340-122-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/2340-123-0x0000000004D60000-0x0000000004D72000-memory.dmp

Filesize
72KB

Download
memory/2340-124-0x0000000004EB2000-0x0000000004EB3000-memory.dmp

Filesize
4KB

Download
memory/2340-125-0x0000000004EB3000-0x0000000004EB4000-memory.dmp

Filesize
4KB

Download
memory/2340-126-0x0000000004D90000-0x0000000004E9A000-memory.dmp

Filesize
1.0MB

Download
memory/2340-127-0x0000000005A00000-0x0000000005A3E000-memory.dmp

Filesize
248KB

Download
memory/2340-128-0x0000000005A50000-0x0000000005A9B000-memory.dmp

Filesize
300KB

Download
memory/2340-129-0x0000000004EB4000-0x0000000004EB6000-memory.dmp

Filesize
8KB

Download
memory/2340-130-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/2340-131-0x00000000063B0000-0x0000000006426000-memory.dmp

Filesize
472KB

Download
memory/2340-132-0x0000000006450000-0x00000000064E2000-memory.dmp

Filesize
584KB

Download
memory/2340-133-0x0000000006540000-0x000000000655E000-memory.dmp

Filesize
120KB

Download
memory/2340-134-0x0000000006770000-0x0000000006932000-memory.dmp

Filesize
1.8MB

Download
memory/2340-135-0x0000000006940000-0x0000000006E6C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing