redline | 43633799f236be62fcc06fb032bf852afb06998b342bb0ec1872fd895a1fcbd4

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12ad82f338b9214be7dca2e2abdd85c.exe
Size

403KB
MD5

b12ad82f338b9214be7dca2e2abdd85c
SHA1

ce750e7e93b64e26af86401121eb6aeb377cb0db
SHA256

43633799f236be62fcc06fb032bf852afb06998b342bb0ec1872fd895a1fcbd4
SHA512

45a30361f87ab02bf071d2a0e8839cbc018d8ad9538951ca81747585a316581de72ef373765df4ee2cb998916512c15bfc4d3f3142927061fb077d4779b6ead7

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

45.9.20.112:57175

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/960-54-0x0000000002090000-0x00000000020C4000-memory.dmp	family_redline
behavioral1/memory/960-55-0x00000000020D0000-0x0000000002102000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b12ad82f338b9214be7dca2e2abdd85c.exe

description pid process

Token: SeDebugPrivilege 960 b12ad82f338b9214be7dca2e2abdd85c.exe

description	pid	process
Token: SeDebugPrivilege	960	b12ad82f338b9214be7dca2e2abdd85c.exe

C:\Users\Admin\AppData\Local\Temp\b12ad82f338b9214be7dca2e2abdd85c.exe
"C:\Users\Admin\AppData\Local\Temp\b12ad82f338b9214be7dca2e2abdd85c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000002090000-0x00000000020C4000-memory.dmp

Filesize
208KB

Download
memory/960-55-0x00000000020D0000-0x0000000002102000-memory.dmp

Filesize
200KB

Download
memory/960-56-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/960-57-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download
memory/960-60-0x00000000049B2000-0x00000000049B3000-memory.dmp

Filesize
4KB

Download
memory/960-59-0x00000000049B1000-0x00000000049B2000-memory.dmp

Filesize
4KB

Download
memory/960-58-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/960-61-0x00000000049B3000-0x00000000049B4000-memory.dmp

Filesize
4KB

Download
memory/960-62-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/960-63-0x00000000049B4000-0x00000000049B6000-memory.dmp

Filesize
8KB

Download