redline | 677b8d2a671f9f2de4e110adaf6eb12f74c9feb15dcd9e6e6c126f668676cf57

General

Target

ebb86bff468a3b482b724efc18a226b5.exe
Size

599KB
MD5

ebb86bff468a3b482b724efc18a226b5
SHA1

8e9d5f32146bb17b56c9cdd61023ace27982c44c
SHA256

677b8d2a671f9f2de4e110adaf6eb12f74c9feb15dcd9e6e6c126f668676cf57
SHA512

a49113e697b58d300b9404b5b5a046240b185c38242c78ac7f26891976915e92439ff8ec636af4c2bad5b0015574c21ea518db10918bc2cf843afdde713854c7

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4320-116-0x00000000002A0000-0x0000000000314000-memory.dmp	family_redline
behavioral2/memory/4320-120-0x00000000002A0000-0x0000000000314000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

pid process

4320 ebb86bff468a3b482b724efc18a226b5.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

pid process

4320 ebb86bff468a3b482b724efc18a226b5.exe
4320 ebb86bff468a3b482b724efc18a226b5.exe
4320 ebb86bff468a3b482b724efc18a226b5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ebb86bff468a3b482b724efc18a226b5.exe

description pid process

Token: SeDebugPrivilege 4320 ebb86bff468a3b482b724efc18a226b5.exe

pid	process
4320	ebb86bff468a3b482b724efc18a226b5.exe

pid	process
4320	ebb86bff468a3b482b724efc18a226b5.exe
4320	ebb86bff468a3b482b724efc18a226b5.exe
4320	ebb86bff468a3b482b724efc18a226b5.exe

description	pid	process
Token: SeDebugPrivilege	4320	ebb86bff468a3b482b724efc18a226b5.exe

C:\Users\Admin\AppData\Local\Temp\ebb86bff468a3b482b724efc18a226b5.exe
"C:\Users\Admin\AppData\Local\Temp\ebb86bff468a3b482b724efc18a226b5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-115-0x00000000024F0000-0x0000000002535000-memory.dmp

Filesize
276KB

Download
memory/4320-116-0x00000000002A0000-0x0000000000314000-memory.dmp

Filesize
464KB

Download
memory/4320-117-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/4320-118-0x0000000075E80000-0x0000000076042000-memory.dmp

Filesize
1.8MB

Download
memory/4320-119-0x0000000073C20000-0x0000000073D11000-memory.dmp

Filesize
964KB

Download
memory/4320-120-0x00000000002A0000-0x0000000000314000-memory.dmp

Filesize
464KB

Download
memory/4320-121-0x0000000071B10000-0x0000000071B90000-memory.dmp

Filesize
512KB

Download
memory/4320-122-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/4320-123-0x0000000076220000-0x00000000767A4000-memory.dmp

Filesize
5.5MB

Download
memory/4320-124-0x00000000747D0000-0x0000000075B18000-memory.dmp

Filesize
19.3MB

Download
memory/4320-125-0x00000000056C0000-0x0000000005CC6000-memory.dmp

Filesize
6.0MB

Download
memory/4320-126-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/4320-127-0x00000000050B0000-0x00000000051BA000-memory.dmp

Filesize
1.0MB

Download
memory/4320-128-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4320-129-0x0000000005390000-0x0000000005552000-memory.dmp

Filesize
1.8MB

Download
memory/4320-130-0x00000000052C0000-0x000000000530B000-memory.dmp

Filesize
300KB

Download
memory/4320-131-0x000000006D5B0000-0x000000006D5FB000-memory.dmp

Filesize
300KB

Download
memory/4320-132-0x0000000000BB0000-0x0000000000C26000-memory.dmp

Filesize
472KB

Download
memory/4320-133-0x0000000000CD0000-0x0000000000D62000-memory.dmp

Filesize
584KB

Download
memory/4320-134-0x00000000061D0000-0x00000000066CE000-memory.dmp

Filesize
5.0MB

Download
memory/4320-135-0x0000000000EB0000-0x0000000000ECE000-memory.dmp

Filesize
120KB

Download
memory/4320-136-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/4320-137-0x0000000006180000-0x00000000061D0000-memory.dmp

Filesize
320KB

Download
memory/4320-138-0x00000000079F0000-0x0000000007F1C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing