redline | 677b8d2a671f9f2de4e110adaf6eb12f74c9feb15dcd9e6e6c126f668676cf57

General

Target

ebb86bff468a3b482b724efc18a226b5.exe
Size

599KB
MD5

ebb86bff468a3b482b724efc18a226b5
SHA1

8e9d5f32146bb17b56c9cdd61023ace27982c44c
SHA256

677b8d2a671f9f2de4e110adaf6eb12f74c9feb15dcd9e6e6c126f668676cf57
SHA512

a49113e697b58d300b9404b5b5a046240b185c38242c78ac7f26891976915e92439ff8ec636af4c2bad5b0015574c21ea518db10918bc2cf843afdde713854c7

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1460-57-0x0000000000120000-0x0000000000194000-memory.dmp	family_redline
behavioral1/memory/1460-65-0x0000000000120000-0x0000000000194000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

pid process

1460 ebb86bff468a3b482b724efc18a226b5.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

pid process

1460 ebb86bff468a3b482b724efc18a226b5.exe
1460 ebb86bff468a3b482b724efc18a226b5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

description pid process

Token: SeDebugPrivilege 1460 ebb86bff468a3b482b724efc18a226b5.exe

pid	process
1460	ebb86bff468a3b482b724efc18a226b5.exe

pid	process
1460	ebb86bff468a3b482b724efc18a226b5.exe
1460	ebb86bff468a3b482b724efc18a226b5.exe

description	pid	process
Token: SeDebugPrivilege	1460	ebb86bff468a3b482b724efc18a226b5.exe

C:\Users\Admin\AppData\Local\Temp\ebb86bff468a3b482b724efc18a226b5.exe
"C:\Users\Admin\AppData\Local\Temp\ebb86bff468a3b482b724efc18a226b5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-54-0x0000000075431000-0x0000000075433000-memory.dmp

Filesize
8KB

Download
memory/1460-55-0x00000000003D0000-0x0000000000415000-memory.dmp

Filesize
276KB

Download
memory/1460-56-0x0000000074DE0000-0x0000000074E2A000-memory.dmp

Filesize
296KB

Download
memory/1460-58-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1460-57-0x0000000000120000-0x0000000000194000-memory.dmp

Filesize
464KB

Download
memory/1460-60-0x00000000767C0000-0x000000007686C000-memory.dmp

Filesize
688KB

Download
memory/1460-61-0x0000000076E90000-0x0000000076ED7000-memory.dmp

Filesize
284KB

Download
memory/1460-62-0x0000000076E10000-0x0000000076E67000-memory.dmp

Filesize
348KB

Download
memory/1460-64-0x0000000075060000-0x00000000751BC000-memory.dmp

Filesize
1.4MB

Download
memory/1460-65-0x0000000000120000-0x0000000000194000-memory.dmp

Filesize
464KB

Download
memory/1460-66-0x00000000763F0000-0x000000007647F000-memory.dmp

Filesize
572KB

Download
memory/1460-68-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1460-69-0x0000000075430000-0x000000007607A000-memory.dmp

Filesize
12.3MB

Download
memory/1460-70-0x0000000073A30000-0x0000000073A47000-memory.dmp

Filesize
92KB

Download
memory/1460-71-0x00000000761B0000-0x00000000761E5000-memory.dmp

Filesize
212KB

Download
memory/1460-72-0x000000006AC50000-0x000000006ADE0000-memory.dmp

Filesize
1.6MB

Download
memory/1460-73-0x000000006AB30000-0x000000006AB47000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing