redline | f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e9a89b2c81e978ff0a06

General

Target

f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
Size

1.3MB
MD5

a6f3ea01902e6522073f27d41806a153
SHA1

6a86c23b5aab14ab057af0888dfd8943eeea3b7b
SHA256

f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e9a89b2c81e978ff0a06
SHA512

6c49100c0e11a9f90ca85546f0ac826aec5e28e9ac498c164ca50ae1b880a5be6141bcc2a58d2815f74e2fcd7a622ff98c125fe72b1c5868eb8d1cb0f1c9a865

Score

10^/10

redline 777 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

777

C2

193.106.191.115:22844

Attributes

auth_value
61f0a4658949823aea34c652fe3cd21d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-56-0x0000000000380000-0x0000000000524000-memory.dmp	family_redline
behavioral1/memory/1668-58-0x0000000000380000-0x0000000000524000-memory.dmp	family_redline
behavioral1/memory/1668-62-0x0000000000380000-0x0000000000524000-memory.dmp	family_redline
behavioral1/memory/1668-69-0x0000000000380000-0x0000000000524000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

pid process

1668 f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

pid process

1668 f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
1668 f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

description pid process

Token: SeDebugPrivilege 1668 f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

pid	process
1668	f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

pid	process
1668	f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
1668	f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

description	pid	process
Token: SeDebugPrivilege	1668	f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe

C:\Users\Admin\AppData\Local\Temp\f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe
"C:\Users\Admin\AppData\Local\Temp\f5c0e1eea15510e4dfdac14b693524b6860b9eb12661e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000074DA0000-0x0000000074DEA000-memory.dmp

Filesize
296KB

Download
memory/1668-56-0x0000000000380000-0x0000000000524000-memory.dmp

Filesize
1.6MB

Download
memory/1668-58-0x0000000000380000-0x0000000000524000-memory.dmp

Filesize
1.6MB

Download
memory/1668-57-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1668-61-0x0000000000330000-0x0000000000376000-memory.dmp

Filesize
280KB

Download
memory/1668-62-0x0000000000380000-0x0000000000524000-memory.dmp

Filesize
1.6MB

Download
memory/1668-63-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1668-60-0x0000000075AA0000-0x0000000075B4C000-memory.dmp

Filesize
688KB

Download
memory/1668-64-0x0000000075760000-0x00000000757A7000-memory.dmp

Filesize
284KB

Download
memory/1668-65-0x0000000075BE0000-0x0000000075C37000-memory.dmp

Filesize
348KB

Download
memory/1668-68-0x0000000075760000-0x00000000757A7000-memory.dmp

Filesize
284KB

Download
memory/1668-67-0x0000000075D40000-0x0000000075E9C000-memory.dmp

Filesize
1.4MB

Download
memory/1668-69-0x0000000000380000-0x0000000000524000-memory.dmp

Filesize
1.6MB

Download
memory/1668-71-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/1668-70-0x00000000770F0000-0x000000007717F000-memory.dmp

Filesize
572KB

Download
memory/1668-73-0x00000000762C0000-0x0000000076F0A000-memory.dmp

Filesize
12.3MB

Download
memory/1668-74-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/1668-75-0x000000006D2A0000-0x000000006D2B7000-memory.dmp

Filesize
92KB

Download
memory/1668-76-0x0000000076000000-0x0000000076035000-memory.dmp

Filesize
212KB

Download
memory/1668-77-0x000000006C080000-0x000000006C210000-memory.dmp

Filesize
1.6MB

Download
memory/1668-78-0x000000006ABE0000-0x000000006ABF7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing