redline | 53b60511d295d3bd9c9524f275a4962d8e1cad17ee84d0676ef16bdae07d26bf

General

Target

e7076a3303f109e81cdf10bfd09b5d0a.exe
Size

468KB
MD5

e7076a3303f109e81cdf10bfd09b5d0a
SHA1

30adb3336dba902cfb3f615394b53480b8976694
SHA256

53b60511d295d3bd9c9524f275a4962d8e1cad17ee84d0676ef16bdae07d26bf
SHA512

5fd8e53f733ce5b45acb80669678adc8cfd7cb4724b522130776a235c6abc2c73310f9f2b8f5e5f1eb20f20ea4ad040a5dda084793b199199a198d8315be610c

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/524-57-0x00000000010B0000-0x0000000001106000-memory.dmp	family_redline
behavioral1/memory/524-65-0x00000000010B0000-0x0000000001106000-memory.dmp	family_redline

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/524-57-0x00000000010B0000-0x0000000001106000-memory.dmp	net_reactor
behavioral1/memory/524-65-0x00000000010B0000-0x0000000001106000-memory.dmp	net_reactor

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e7076a3303f109e81cdf10bfd09b5d0a.exe

pid process

524 e7076a3303f109e81cdf10bfd09b5d0a.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e7076a3303f109e81cdf10bfd09b5d0a.exe

pid process

524 e7076a3303f109e81cdf10bfd09b5d0a.exe
524 e7076a3303f109e81cdf10bfd09b5d0a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e7076a3303f109e81cdf10bfd09b5d0a.exe

description pid process

Token: SeDebugPrivilege 524 e7076a3303f109e81cdf10bfd09b5d0a.exe

pid	process
524	e7076a3303f109e81cdf10bfd09b5d0a.exe

pid	process
524	e7076a3303f109e81cdf10bfd09b5d0a.exe
524	e7076a3303f109e81cdf10bfd09b5d0a.exe

description	pid	process
Token: SeDebugPrivilege	524	e7076a3303f109e81cdf10bfd09b5d0a.exe

C:\Users\Admin\AppData\Local\Temp\e7076a3303f109e81cdf10bfd09b5d0a.exe
"C:\Users\Admin\AppData\Local\Temp\e7076a3303f109e81cdf10bfd09b5d0a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/524-56-0x0000000000410000-0x0000000000454000-memory.dmp

Filesize
272KB

Download
memory/524-55-0x00000000747B0000-0x00000000747FA000-memory.dmp

Filesize
296KB

Download
memory/524-57-0x00000000010B0000-0x0000000001106000-memory.dmp

Filesize
344KB

Download
memory/524-58-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/524-60-0x0000000076490000-0x000000007653C000-memory.dmp

Filesize
688KB

Download
memory/524-61-0x0000000074E50000-0x0000000074E97000-memory.dmp

Filesize
284KB

Download
memory/524-62-0x0000000074EA0000-0x0000000074EF7000-memory.dmp

Filesize
348KB

Download
memory/524-64-0x0000000075B50000-0x0000000075CAC000-memory.dmp

Filesize
1.4MB

Download
memory/524-65-0x00000000010B0000-0x0000000001106000-memory.dmp

Filesize
344KB

Download
memory/524-66-0x0000000076CB0000-0x0000000076D3F000-memory.dmp

Filesize
572KB

Download
memory/524-69-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/524-68-0x0000000074F00000-0x0000000075B4A000-memory.dmp

Filesize
12.3MB

Download
memory/524-70-0x00000000735A0000-0x00000000735B7000-memory.dmp

Filesize
92KB

Download
memory/524-71-0x0000000076450000-0x0000000076485000-memory.dmp

Filesize
212KB

Download
memory/524-72-0x000000006A7C0000-0x000000006A950000-memory.dmp

Filesize
1.6MB

Download
memory/524-73-0x000000006A550000-0x000000006A567000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing