redline | 18a2ca4b4f0a41b87f12ce121488a656e3db3a59a3934bbcb76d7e8d3113c363

General

Target

3290b8a28d937417e38c54224d1af29e.exe
Size

666KB
MD5

3290b8a28d937417e38c54224d1af29e
SHA1

5c228fdd851667ae7091ec3de1ad2a4742bc16b8
SHA256

18a2ca4b4f0a41b87f12ce121488a656e3db3a59a3934bbcb76d7e8d3113c363
SHA512

353f90bc030d8af1b8568c70a845d069669968bcaf0ced8d179239bf96d2a49afe743d1aafbfaf48edf5e11d4a2b314c352cef6cd63ba7721d77844ae94579a8

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1224-58-0x0000000000DD0000-0x0000000000E56000-memory.dmp	family_redline
behavioral1/memory/1224-66-0x0000000000DD0000-0x0000000000E56000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

3290b8a28d937417e38c54224d1af29e.exe

pid process

1224 3290b8a28d937417e38c54224d1af29e.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3290b8a28d937417e38c54224d1af29e.exe

pid process

1224 3290b8a28d937417e38c54224d1af29e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3290b8a28d937417e38c54224d1af29e.exe

description pid process

Token: SeDebugPrivilege 1224 3290b8a28d937417e38c54224d1af29e.exe

pid	process
1224	3290b8a28d937417e38c54224d1af29e.exe

pid	process
1224	3290b8a28d937417e38c54224d1af29e.exe

description	pid	process
Token: SeDebugPrivilege	1224	3290b8a28d937417e38c54224d1af29e.exe

C:\Users\Admin\AppData\Local\Temp\3290b8a28d937417e38c54224d1af29e.exe
"C:\Users\Admin\AppData\Local\Temp\3290b8a28d937417e38c54224d1af29e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000000830000-0x0000000000874000-memory.dmp

Filesize
272KB

Download
memory/1224-57-0x00000000751E0000-0x000000007522A000-memory.dmp

Filesize
296KB

Download
memory/1224-58-0x0000000000DD0000-0x0000000000E56000-memory.dmp

Filesize
536KB

Download
memory/1224-61-0x0000000075720000-0x00000000757CC000-memory.dmp

Filesize
688KB

Download
memory/1224-62-0x0000000076000000-0x0000000076047000-memory.dmp

Filesize
284KB

Download
memory/1224-63-0x0000000077060000-0x00000000770B7000-memory.dmp

Filesize
348KB

Download
memory/1224-65-0x0000000077380000-0x00000000774DC000-memory.dmp

Filesize
1.4MB

Download
memory/1224-66-0x0000000000DD0000-0x0000000000E56000-memory.dmp

Filesize
536KB

Download
memory/1224-67-0x0000000075C20000-0x0000000075CAF000-memory.dmp

Filesize
572KB

Download
memory/1224-69-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/1224-70-0x00000000760F0000-0x0000000076D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1224-71-0x000000006C450000-0x000000006C467000-memory.dmp

Filesize
92KB

Download
memory/1224-72-0x0000000075A30000-0x0000000075A65000-memory.dmp

Filesize
212KB

Download
memory/1224-73-0x000000006AF50000-0x000000006B0E0000-memory.dmp

Filesize
1.6MB

Download
memory/1224-74-0x000000006AE30000-0x000000006AE47000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing