redline | cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a

General

Target

cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe
Size

388KB
MD5

28604a102c036c2368ff23252427f237
SHA1

9f2f19173c8ad1562da8a0262f563eaf50b097f5
SHA256

cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a
SHA512

aab2c4c9d7af988ea7c0fe986d34899b85c45f947c3ddf437d1bb25c47292c895fd66a288fba17a333d7bbcbd6fbf36115d99c42643451e01c6814487b5828de

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2720-118-0x00000000021F0000-0x0000000002224000-memory.dmp	family_redline
behavioral1/memory/2720-120-0x00000000024A0000-0x00000000024D2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe

description pid process

Token: SeDebugPrivilege 2720 cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe

description	pid	process
Token: SeDebugPrivilege	2720	cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe

C:\Users\Admin\AppData\Local\Temp\cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe
"C:\Users\Admin\AppData\Local\Temp\cdd83fac47585fb7c0b6d354b68797b7979eced3f0f1305e5553829b2362077a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-115-0x00000000004E0000-0x000000000062A000-memory.dmp

Filesize
1.3MB

Download
memory/2720-116-0x0000000000900000-0x0000000000939000-memory.dmp

Filesize
228KB

Download
memory/2720-117-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2720-118-0x00000000021F0000-0x0000000002224000-memory.dmp

Filesize
208KB

Download
memory/2720-119-0x0000000004DF0000-0x00000000052EE000-memory.dmp

Filesize
5.0MB

Download
memory/2720-120-0x00000000024A0000-0x00000000024D2000-memory.dmp

Filesize
200KB

Download
memory/2720-121-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2720-122-0x0000000004DE2000-0x0000000004DE3000-memory.dmp

Filesize
4KB

Download
memory/2720-123-0x0000000004DE3000-0x0000000004DE4000-memory.dmp

Filesize
4KB

Download
memory/2720-124-0x00000000052F0000-0x00000000058F6000-memory.dmp

Filesize
6.0MB

Download
memory/2720-125-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/2720-126-0x0000000004C90000-0x0000000004D9A000-memory.dmp

Filesize
1.0MB

Download
memory/2720-127-0x0000000004DA0000-0x0000000004DDE000-memory.dmp

Filesize
248KB

Download
memory/2720-128-0x0000000004DE4000-0x0000000004DE6000-memory.dmp

Filesize
8KB

Download
memory/2720-129-0x0000000005900000-0x000000000594B000-memory.dmp

Filesize
300KB

Download
memory/2720-130-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Filesize
408KB

Download
memory/2720-131-0x0000000006260000-0x00000000062D6000-memory.dmp

Filesize
472KB

Download
memory/2720-132-0x00000000062E0000-0x0000000006372000-memory.dmp

Filesize
584KB

Download
memory/2720-133-0x00000000064F0000-0x000000000650E000-memory.dmp

Filesize
120KB

Download
memory/2720-134-0x0000000006720000-0x00000000068E2000-memory.dmp

Filesize
1.8MB

Download
memory/2720-135-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing