redline | 9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df

General

Target

9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe
Size

440KB
MD5

985200f2a157f985b944fe4932bce0ad
SHA1

e99e68c6aac7b75048f5bb01f0cb5cf44ed68d1a
SHA256

9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df
SHA512

9ca896d66c755e030d87aaaff6f9e0c3e315676345039c3fb5e8526cc241d79d0f0f5ac16292aefc80b2026f42b7af3b45946ece4ce8c3c19f978c0692c6453c

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-119-0x0000000002A40000-0x0000000002A74000-memory.dmp	family_redline
behavioral1/memory/1496-121-0x0000000002A70000-0x0000000002AA2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe

description pid process

Token: SeDebugPrivilege 1496 9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe

description	pid	process
Token: SeDebugPrivilege	1496	9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe

C:\Users\Admin\AppData\Local\Temp\9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe
"C:\Users\Admin\AppData\Local\Temp\9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-114-0x00000000009EA000-0x0000000000A16000-memory.dmp

Filesize
176KB

Download
memory/1496-115-0x00000000009EA000-0x0000000000A16000-memory.dmp

Filesize
176KB

Download
memory/1496-116-0x00000000025B0000-0x00000000025E9000-memory.dmp

Filesize
228KB

Download
memory/1496-117-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1496-118-0x000000007319E000-0x000000007319F000-memory.dmp

Filesize
4KB

Download
memory/1496-119-0x0000000002A40000-0x0000000002A74000-memory.dmp

Filesize
208KB

Download
memory/1496-120-0x00000000050A0000-0x000000000559E000-memory.dmp

Filesize
5.0MB

Download
memory/1496-121-0x0000000002A70000-0x0000000002AA2000-memory.dmp

Filesize
200KB

Download
memory/1496-122-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/1496-123-0x0000000005092000-0x0000000005093000-memory.dmp

Filesize
4KB

Download
memory/1496-124-0x0000000005093000-0x0000000005094000-memory.dmp

Filesize
4KB

Download
memory/1496-125-0x00000000055A0000-0x0000000005BA6000-memory.dmp

Filesize
6.0MB

Download
memory/1496-126-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download
memory/1496-127-0x0000000005BB0000-0x0000000005CBA000-memory.dmp

Filesize
1.0MB

Download
memory/1496-128-0x0000000005050000-0x000000000508E000-memory.dmp

Filesize
248KB

Download
memory/1496-129-0x0000000005CD0000-0x0000000005D1B000-memory.dmp

Filesize
300KB

Download
memory/1496-130-0x0000000005094000-0x0000000005096000-memory.dmp

Filesize
8KB

Download
memory/1496-131-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Filesize
408KB

Download
memory/1496-132-0x0000000006630000-0x00000000066A6000-memory.dmp

Filesize
472KB

Download
memory/1496-133-0x00000000066B0000-0x0000000006742000-memory.dmp

Filesize
584KB

Download
memory/1496-134-0x00000000068C0000-0x00000000068DE000-memory.dmp

Filesize
120KB

Download
memory/1496-135-0x00000000069F0000-0x0000000006BB2000-memory.dmp

Filesize
1.8MB

Download
memory/1496-136-0x0000000006BC0000-0x00000000070EC000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing