redline | 48c2a26e7e2f02bb50389fae8a5c44d0d7950e1dfe46a2d1d5aadf580db7b8e2

General

Target

5c71b8bed631eeeca7e373e0d0b8bfa4.exe
Size

509KB
MD5

5c71b8bed631eeeca7e373e0d0b8bfa4
SHA1

c79d31368ad2f03ecdcc82093f0d165d4445415c
SHA256

48c2a26e7e2f02bb50389fae8a5c44d0d7950e1dfe46a2d1d5aadf580db7b8e2
SHA512

e7956198551739624d4dd13d61d6f54ad2d16d3503765464d0bbcae0e67cc0b20bcbba6d5e365a5616552b3dcd00358a679cf9bd852409772b2253a1c0174137

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-57-0x00000000013E0000-0x0000000001463000-memory.dmp	family_redline
behavioral1/memory/1912-65-0x00000000013E0000-0x0000000001463000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

5c71b8bed631eeeca7e373e0d0b8bfa4.exe

pid process

1912 5c71b8bed631eeeca7e373e0d0b8bfa4.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5c71b8bed631eeeca7e373e0d0b8bfa4.exe

pid process

1912 5c71b8bed631eeeca7e373e0d0b8bfa4.exe
1912 5c71b8bed631eeeca7e373e0d0b8bfa4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5c71b8bed631eeeca7e373e0d0b8bfa4.exe

description pid process

Token: SeDebugPrivilege 1912 5c71b8bed631eeeca7e373e0d0b8bfa4.exe

pid	process
1912	5c71b8bed631eeeca7e373e0d0b8bfa4.exe

pid	process
1912	5c71b8bed631eeeca7e373e0d0b8bfa4.exe
1912	5c71b8bed631eeeca7e373e0d0b8bfa4.exe

description	pid	process
Token: SeDebugPrivilege	1912	5c71b8bed631eeeca7e373e0d0b8bfa4.exe

C:\Users\Admin\AppData\Local\Temp\5c71b8bed631eeeca7e373e0d0b8bfa4.exe
"C:\Users\Admin\AppData\Local\Temp\5c71b8bed631eeeca7e373e0d0b8bfa4.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x0000000074C90000-0x0000000074CDA000-memory.dmp

Filesize
296KB

Download
memory/1912-56-0x00000000001D0000-0x0000000000214000-memory.dmp

Filesize
272KB

Download
memory/1912-57-0x00000000013E0000-0x0000000001463000-memory.dmp

Filesize
524KB

Download
memory/1912-58-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1912-60-0x0000000077170000-0x000000007721C000-memory.dmp

Filesize
688KB

Download
memory/1912-61-0x0000000075300000-0x0000000075347000-memory.dmp

Filesize
284KB

Download
memory/1912-62-0x0000000076A10000-0x0000000076A67000-memory.dmp

Filesize
348KB

Download
memory/1912-64-0x00000000750C0000-0x000000007521C000-memory.dmp

Filesize
1.4MB

Download
memory/1912-65-0x00000000013E0000-0x0000000001463000-memory.dmp

Filesize
524KB

Download
memory/1912-66-0x0000000076420000-0x00000000764AF000-memory.dmp

Filesize
572KB

Download
memory/1912-69-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/1912-68-0x0000000075760000-0x00000000763AA000-memory.dmp

Filesize
12.3MB

Download
memory/1912-70-0x0000000073CD0000-0x0000000073CE7000-memory.dmp

Filesize
92KB

Download
memory/1912-71-0x0000000076740000-0x0000000076775000-memory.dmp

Filesize
212KB

Download
memory/1912-72-0x00000000738C0000-0x00000000738DC000-memory.dmp

Filesize
112KB

Download
memory/1912-73-0x000000006BD60000-0x000000006BD75000-memory.dmp

Filesize
84KB

Download
memory/1912-74-0x000000006BD80000-0x000000006BDD2000-memory.dmp

Filesize
328KB

Download
memory/1912-75-0x000000006BD50000-0x000000006BD5D000-memory.dmp

Filesize
52KB

Download
memory/1912-76-0x0000000075350000-0x0000000075369000-memory.dmp

Filesize
100KB

Download
memory/1912-77-0x000000006BCA0000-0x000000006BCEF000-memory.dmp

Filesize
316KB

Download
memory/1912-78-0x000000006BCF0000-0x000000006BD48000-memory.dmp

Filesize
352KB

Download
memory/1912-79-0x0000000075030000-0x000000007503C000-memory.dmp

Filesize
48KB

Download
memory/1912-81-0x00000000752C0000-0x00000000752E7000-memory.dmp

Filesize
156KB

Download
memory/1912-82-0x000000006C0E0000-0x000000006C124000-memory.dmp

Filesize
272KB

Download
memory/1912-83-0x000000006BB20000-0x000000006BB5D000-memory.dmp

Filesize
244KB

Download
memory/1912-84-0x0000000075370000-0x000000007537C000-memory.dmp

Filesize
48KB

Download
memory/1912-85-0x0000000077050000-0x000000007716D000-memory.dmp

Filesize
1.1MB

Download
memory/1912-86-0x0000000074BE0000-0x0000000074BEB000-memory.dmp

Filesize
44KB

Download
memory/1912-87-0x000000006BB00000-0x000000006BB17000-memory.dmp

Filesize
92KB

Download
memory/1912-88-0x000000006BB60000-0x000000006BB98000-memory.dmp

Filesize
224KB

Download
memory/1912-90-0x000000006AAA0000-0x000000006AC30000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing