redline | 76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff

General

Target

76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe
Size

441KB
MD5

28f33dfe8be3e4a428346e30351a1995
SHA1

e733150e11099eb9bae9f02cdae7cb759d3b570a
SHA256

76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff
SHA512

51316bb897808b8b1fdf0648e41c797fcc41d9932cb3edeaa25336e8bd51a4ffdcaf50928e9c7e318527016a2736e62485630bd8fd3f47d468c6931cd40b80fc

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1488-115-0x00000000027A0000-0x00000000027D4000-memory.dmp	family_redline
behavioral1/memory/1488-117-0x0000000002960000-0x0000000002992000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe

description pid process

Token: SeDebugPrivilege 1488 76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe

description	pid	process
Token: SeDebugPrivilege	1488	76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe

C:\Users\Admin\AppData\Local\Temp\76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe
"C:\Users\Admin\AppData\Local\Temp\76f4e8c50ece719c504376db8e131a8afcf8307e21ec864439452ac66f1da7ff.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-114-0x0000000000BAA000-0x0000000000BD6000-memory.dmp

Filesize
176KB

Download
memory/1488-115-0x00000000027A0000-0x00000000027D4000-memory.dmp

Filesize
208KB

Download
memory/1488-116-0x00000000051A0000-0x000000000569E000-memory.dmp

Filesize
5.0MB

Download
memory/1488-117-0x0000000002960000-0x0000000002992000-memory.dmp

Filesize
200KB

Download
memory/1488-118-0x0000000000BAA000-0x0000000000BD6000-memory.dmp

Filesize
176KB

Download
memory/1488-119-0x0000000000B00000-0x0000000000B39000-memory.dmp

Filesize
228KB

Download
memory/1488-120-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1488-121-0x000000007335E000-0x000000007335F000-memory.dmp

Filesize
4KB

Download
memory/1488-122-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1488-123-0x0000000002E42000-0x0000000002E43000-memory.dmp

Filesize
4KB

Download
memory/1488-124-0x0000000002E43000-0x0000000002E44000-memory.dmp

Filesize
4KB

Download
memory/1488-125-0x00000000056A0000-0x0000000005CA6000-memory.dmp

Filesize
6.0MB

Download
memory/1488-126-0x0000000002C90000-0x0000000002CA2000-memory.dmp

Filesize
72KB

Download
memory/1488-127-0x0000000002CF0000-0x0000000002DFA000-memory.dmp

Filesize
1.0MB

Download
memory/1488-128-0x0000000005CB0000-0x0000000005CEE000-memory.dmp

Filesize
248KB

Download
memory/1488-129-0x0000000005CF0000-0x0000000005D3B000-memory.dmp

Filesize
300KB

Download
memory/1488-130-0x0000000002E44000-0x0000000002E46000-memory.dmp

Filesize
8KB

Download
memory/1488-131-0x0000000005F70000-0x0000000005FE6000-memory.dmp

Filesize
472KB

Download
memory/1488-132-0x0000000006060000-0x00000000060F2000-memory.dmp

Filesize
584KB

Download
memory/1488-133-0x0000000006030000-0x000000000604E000-memory.dmp

Filesize
120KB

Download
memory/1488-134-0x0000000006240000-0x00000000062A6000-memory.dmp

Filesize
408KB

Download
memory/1488-135-0x0000000006980000-0x0000000006B42000-memory.dmp

Filesize
1.8MB

Download
memory/1488-136-0x0000000006B60000-0x000000000708C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing