redline | 59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3

General

Target

cb37b2c03cca2f4ae68d7e2b7f8e8493.exe
Size

178KB
MD5

cb37b2c03cca2f4ae68d7e2b7f8e8493
SHA1

ca21f84498ddf02eef6ebbbb6f9c7f1f64d97cc2
SHA256

59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3
SHA512

9601bb4dba108a963edc802569928e7c519f7bb22985b328577ea85eea5a31b423deb55344a1863302624c2649c0c79006a0f41e107407f802aa27beaa26942b

Score

10^/10

redline 2 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

2

C2

45.72.110.144:8890

Attributes

auth_value
666a53b9a643121a4307a6a283389db6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2004-130-0x0000000000B30000-0x0000000000B62000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cb37b2c03cca2f4ae68d7e2b7f8e8493.exe

pid process

2004 cb37b2c03cca2f4ae68d7e2b7f8e8493.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cb37b2c03cca2f4ae68d7e2b7f8e8493.exe

description pid process

Token: SeDebugPrivilege 2004 cb37b2c03cca2f4ae68d7e2b7f8e8493.exe

pid	process
2004	cb37b2c03cca2f4ae68d7e2b7f8e8493.exe

description	pid	process
Token: SeDebugPrivilege	2004	cb37b2c03cca2f4ae68d7e2b7f8e8493.exe

C:\Users\Admin\AppData\Local\Temp\cb37b2c03cca2f4ae68d7e2b7f8e8493.exe
"C:\Users\Admin\AppData\Local\Temp\cb37b2c03cca2f4ae68d7e2b7f8e8493.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-130-0x0000000000B30000-0x0000000000B62000-memory.dmp

Filesize
200KB

Download
memory/2004-131-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2004-132-0x00000000061A0000-0x00000000067B8000-memory.dmp

Filesize
6.1MB

Download
memory/2004-133-0x0000000006110000-0x0000000006122000-memory.dmp

Filesize
72KB

Download
memory/2004-134-0x0000000007B30000-0x0000000007C3A000-memory.dmp

Filesize
1.0MB

Download
memory/2004-135-0x0000000007AA0000-0x0000000007ADC000-memory.dmp

Filesize
240KB

Download
memory/2004-136-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/2004-137-0x00000000088C0000-0x0000000008936000-memory.dmp

Filesize
472KB

Download
memory/2004-138-0x00000000089E0000-0x0000000008A72000-memory.dmp

Filesize
584KB

Download
memory/2004-139-0x0000000009030000-0x00000000095D4000-memory.dmp

Filesize
5.6MB

Download
memory/2004-140-0x0000000008C80000-0x0000000008C9E000-memory.dmp

Filesize
120KB

Download
memory/2004-141-0x0000000008D60000-0x0000000008DC6000-memory.dmp

Filesize
408KB

Download
memory/2004-142-0x0000000005561000-0x0000000005562000-memory.dmp

Filesize
4KB

Download
memory/2004-143-0x0000000009630000-0x0000000009680000-memory.dmp

Filesize
320KB

Download
memory/2004-144-0x0000000009950000-0x0000000009B12000-memory.dmp

Filesize
1.8MB

Download
memory/2004-145-0x000000000A050000-0x000000000A57C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing