redline | 6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c

General

Target

6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe
Size

329KB
MD5

31ec7cf1960eab3f602ca31db2822978
SHA1

6453c8e5a1dca58a677414154201052395ff998a
SHA256

6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c
SHA512

8bbb9c4099ba15c286d8c6808cc2599e0b4bc6753afe20c77f079f2d018ca53c63fec519ef6d6434bba9dfcbcee4ff784144ae156749f06edf4858cf38ee94e0

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2152-118-0x00000000022B0000-0x00000000022E4000-memory.dmp	family_redline
behavioral1/memory/2152-123-0x00000000025B0000-0x00000000025E2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe

description pid process

Token: SeDebugPrivilege 2152 6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe

description	pid	process
Token: SeDebugPrivilege	2152	6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe

C:\Users\Admin\AppData\Local\Temp\6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe
"C:\Users\Admin\AppData\Local\Temp\6b97e923ce47873734265aef68a7a38f0e54493e5e3ef9fc18ce8327b88ca55c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-115-0x0000000000670000-0x00000000006B6000-memory.dmp

Filesize
280KB

Download
memory/2152-116-0x00000000005D0000-0x0000000000609000-memory.dmp

Filesize
228KB

Download
memory/2152-117-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2152-118-0x00000000022B0000-0x00000000022E4000-memory.dmp

Filesize
208KB

Download
memory/2152-119-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/2152-121-0x0000000004D13000-0x0000000004D14000-memory.dmp

Filesize
4KB

Download
memory/2152-120-0x0000000004D12000-0x0000000004D13000-memory.dmp

Filesize
4KB

Download
memory/2152-122-0x0000000004D20000-0x000000000521E000-memory.dmp

Filesize
5.0MB

Download
memory/2152-123-0x00000000025B0000-0x00000000025E2000-memory.dmp

Filesize
200KB

Download
memory/2152-124-0x0000000005220000-0x0000000005826000-memory.dmp

Filesize
6.0MB

Download
memory/2152-125-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/2152-126-0x0000000004C00000-0x0000000004D0A000-memory.dmp

Filesize
1.0MB

Download
memory/2152-127-0x0000000005870000-0x00000000058AE000-memory.dmp

Filesize
248KB

Download
memory/2152-128-0x0000000004D14000-0x0000000004D16000-memory.dmp

Filesize
8KB

Download
memory/2152-129-0x00000000058C0000-0x000000000590B000-memory.dmp

Filesize
300KB

Download
memory/2152-130-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/2152-131-0x0000000006220000-0x0000000006296000-memory.dmp

Filesize
472KB

Download
memory/2152-132-0x00000000062C0000-0x0000000006352000-memory.dmp

Filesize
584KB

Download
memory/2152-133-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/2152-134-0x00000000065E0000-0x00000000067A2000-memory.dmp

Filesize
1.8MB

Download
memory/2152-135-0x00000000067B0000-0x0000000006CDC000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing