redline | 880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64

General

Target

07a7b333916388a9c79677654bd38c58.exe
Size

735KB
MD5

07a7b333916388a9c79677654bd38c58
SHA1

654845924294710677dec0c184dea4f449d34bf9
SHA256

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64
SHA512

6f13f24779c50410bc4fd110f877654be15c4992da7c06b89c475a5d5dab744324bd3ed01a28fb153907d0c72dceeb6f4d5a4d3e0c5cda9ac2d02821c5306f7c

Score

10^/10

redline proliv2 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

proliv2

C2

95.216.16.35:80

Attributes

auth_value
ca42c778a3f4017ddf8a466bc0b417b1

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1780-56-0x0000000000880000-0x0000000000ABD000-memory.dmp	family_redline
behavioral1/memory/1780-63-0x0000000000880000-0x0000000000ABD000-memory.dmp	family_redline
behavioral1/memory/1780-68-0x0000000000880000-0x0000000000ABD000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

pid process

1780 07a7b333916388a9c79677654bd38c58.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

pid process

1780 07a7b333916388a9c79677654bd38c58.exe
1780 07a7b333916388a9c79677654bd38c58.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

description pid process

Token: SeDebugPrivilege 1780 07a7b333916388a9c79677654bd38c58.exe

pid	process
1780	07a7b333916388a9c79677654bd38c58.exe

pid	process
1780	07a7b333916388a9c79677654bd38c58.exe
1780	07a7b333916388a9c79677654bd38c58.exe

description	pid	process
Token: SeDebugPrivilege	1780	07a7b333916388a9c79677654bd38c58.exe

C:\Users\Admin\AppData\Local\Temp\07a7b333916388a9c79677654bd38c58.exe
"C:\Users\Admin\AppData\Local\Temp\07a7b333916388a9c79677654bd38c58.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1780-55-0x00000000754D0000-0x000000007551A000-memory.dmp

Filesize
296KB

Download
memory/1780-56-0x0000000000880000-0x0000000000ABD000-memory.dmp

Filesize
2.2MB

Download
memory/1780-57-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1780-59-0x0000000077570000-0x000000007761C000-memory.dmp

Filesize
688KB

Download
memory/1780-60-0x00000000759E0000-0x0000000075A27000-memory.dmp

Filesize
284KB

Download
memory/1780-61-0x0000000077900000-0x0000000077957000-memory.dmp

Filesize
348KB

Download
memory/1780-62-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/1780-64-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1780-63-0x0000000000880000-0x0000000000ABD000-memory.dmp

Filesize
2.2MB

Download
memory/1780-65-0x00000000759E0000-0x0000000075A27000-memory.dmp

Filesize
284KB

Download
memory/1780-67-0x0000000077350000-0x00000000774AC000-memory.dmp

Filesize
1.4MB

Download
memory/1780-68-0x0000000000880000-0x0000000000ABD000-memory.dmp

Filesize
2.2MB

Download
memory/1780-69-0x0000000076A10000-0x0000000076A9F000-memory.dmp

Filesize
572KB

Download
memory/1780-72-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/1780-71-0x0000000075BE0000-0x000000007682A000-memory.dmp

Filesize
12.3MB

Download
memory/1780-73-0x000000006DA70000-0x000000006DA87000-memory.dmp

Filesize
92KB

Download
memory/1780-74-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1780-75-0x0000000075BA0000-0x0000000075BD5000-memory.dmp

Filesize
212KB

Download
memory/1780-76-0x000000006DA00000-0x000000006DA1C000-memory.dmp

Filesize
112KB

Download
memory/1780-77-0x000000006D8F0000-0x000000006D905000-memory.dmp

Filesize
84KB

Download
memory/1780-78-0x000000006D910000-0x000000006D962000-memory.dmp

Filesize
328KB

Download
memory/1780-79-0x000000006D8E0000-0x000000006D8ED000-memory.dmp

Filesize
52KB

Download
memory/1780-80-0x0000000076F00000-0x0000000076F19000-memory.dmp

Filesize
100KB

Download
memory/1780-81-0x000000006D830000-0x000000006D87F000-memory.dmp

Filesize
316KB

Download
memory/1780-82-0x000000006D880000-0x000000006D8D8000-memory.dmp

Filesize
352KB

Download
memory/1780-83-0x0000000075770000-0x000000007577C000-memory.dmp

Filesize
48KB

Download
memory/1780-85-0x0000000076920000-0x0000000076947000-memory.dmp

Filesize
156KB

Download
memory/1780-86-0x000000006D9A0000-0x000000006D9E4000-memory.dmp

Filesize
272KB

Download
memory/1780-87-0x00000000774C0000-0x00000000774C5000-memory.dmp

Filesize
20KB

Download
memory/1780-88-0x0000000076F00000-0x0000000076F19000-memory.dmp

Filesize
100KB

Download
memory/1780-89-0x000000006D6B0000-0x000000006D6ED000-memory.dmp

Filesize
244KB

Download
memory/1780-90-0x0000000076960000-0x000000007696C000-memory.dmp

Filesize
48KB

Download
memory/1780-91-0x0000000076AA0000-0x0000000076BBD000-memory.dmp

Filesize
1.1MB

Download
memory/1780-92-0x0000000075420000-0x000000007542B000-memory.dmp

Filesize
44KB

Download
memory/1780-93-0x000000006D690000-0x000000006D6A7000-memory.dmp

Filesize
92KB

Download
memory/1780-94-0x000000006D6F0000-0x000000006D728000-memory.dmp

Filesize
224KB

Download
memory/1780-96-0x000000006C1C0000-0x000000006C350000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing