redline | 880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64

General

Target

07a7b333916388a9c79677654bd38c58.exe
Size

735KB
MD5

07a7b333916388a9c79677654bd38c58
SHA1

654845924294710677dec0c184dea4f449d34bf9
SHA256

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64
SHA512

6f13f24779c50410bc4fd110f877654be15c4992da7c06b89c475a5d5dab744324bd3ed01a28fb153907d0c72dceeb6f4d5a4d3e0c5cda9ac2d02821c5306f7c

Score

10^/10

redline proliv2 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

proliv2

C2

95.216.16.35:80

Attributes

auth_value
ca42c778a3f4017ddf8a466bc0b417b1

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3660-131-0x00000000000B0000-0x00000000002ED000-memory.dmp	family_redline
behavioral2/memory/3660-133-0x00000000000B0000-0x00000000002ED000-memory.dmp	family_redline
behavioral2/memory/3660-137-0x00000000000B0000-0x00000000002ED000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

pid process

3660 07a7b333916388a9c79677654bd38c58.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

pid process

3660 07a7b333916388a9c79677654bd38c58.exe
3660 07a7b333916388a9c79677654bd38c58.exe
3660 07a7b333916388a9c79677654bd38c58.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07a7b333916388a9c79677654bd38c58.exe

description pid process

Token: SeDebugPrivilege 3660 07a7b333916388a9c79677654bd38c58.exe

pid	process
3660	07a7b333916388a9c79677654bd38c58.exe

pid	process
3660	07a7b333916388a9c79677654bd38c58.exe
3660	07a7b333916388a9c79677654bd38c58.exe
3660	07a7b333916388a9c79677654bd38c58.exe

description	pid	process
Token: SeDebugPrivilege	3660	07a7b333916388a9c79677654bd38c58.exe

C:\Users\Admin\AppData\Local\Temp\07a7b333916388a9c79677654bd38c58.exe
"C:\Users\Admin\AppData\Local\Temp\07a7b333916388a9c79677654bd38c58.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3660-130-0x0000000002FA0000-0x0000000002FE6000-memory.dmp

Filesize
280KB

Download
memory/3660-131-0x00000000000B0000-0x00000000002ED000-memory.dmp

Filesize
2.2MB

Download
memory/3660-132-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/3660-133-0x00000000000B0000-0x00000000002ED000-memory.dmp

Filesize
2.2MB

Download
memory/3660-134-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/3660-135-0x00000000755E0000-0x00000000757F5000-memory.dmp

Filesize
2.1MB

Download
memory/3660-136-0x00000000741C0000-0x0000000074970000-memory.dmp

Filesize
7.7MB

Download
memory/3660-137-0x00000000000B0000-0x00000000002ED000-memory.dmp

Filesize
2.2MB

Download
memory/3660-138-0x0000000072C50000-0x0000000072CD9000-memory.dmp

Filesize
548KB

Download
memory/3660-139-0x0000000076830000-0x0000000076DE3000-memory.dmp

Filesize
5.7MB

Download
memory/3660-140-0x0000000005FF0000-0x0000000006608000-memory.dmp

Filesize
6.1MB

Download
memory/3660-141-0x0000000005A10000-0x0000000005A22000-memory.dmp

Filesize
72KB

Download
memory/3660-142-0x0000000005B40000-0x0000000005C4A000-memory.dmp

Filesize
1.0MB

Download
memory/3660-143-0x0000000005A70000-0x0000000005AAC000-memory.dmp

Filesize
240KB

Download
memory/3660-144-0x00000000059D0000-0x0000000005FE8000-memory.dmp

Filesize
6.1MB

Download
memory/3660-145-0x000000006E460000-0x000000006E4AC000-memory.dmp

Filesize
304KB

Download
memory/3660-146-0x0000000007200000-0x00000000077A4000-memory.dmp

Filesize
5.6MB

Download
memory/3660-147-0x0000000006CF0000-0x0000000006D82000-memory.dmp

Filesize
584KB

Download
memory/3660-148-0x0000000006D90000-0x0000000006E06000-memory.dmp

Filesize
472KB

Download
memory/3660-149-0x0000000006F50000-0x0000000006F6E000-memory.dmp

Filesize
120KB

Download
memory/3660-150-0x0000000007140000-0x00000000071A6000-memory.dmp

Filesize
408KB

Download
memory/3660-151-0x0000000007A80000-0x0000000007C42000-memory.dmp

Filesize
1.8MB

Download
memory/3660-152-0x0000000008180000-0x00000000086AC000-memory.dmp

Filesize
5.2MB

Download
memory/3660-153-0x0000000007DA0000-0x0000000007DF0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing