redline | 3cd108b7f88e3c35febc8858c5bfe4d3737d4b5596a0616d0ac259a5333c8b44

Analysis

max time kernel
65s
max time network
68s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-04-2022 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04875c48adccb44ffcb18af8ac581112.exe
Size

377KB
MD5

04875c48adccb44ffcb18af8ac581112
SHA1

e83a38e661ef63de1ba879a1e22186a16d65c358
SHA256

3cd108b7f88e3c35febc8858c5bfe4d3737d4b5596a0616d0ac259a5333c8b44
SHA512

932393210b26e7b46c082b7bf441f7a2ad7e622b4cc596336a7733b80f408327a4da713edf9139bda8e98435575041e4e028e28c759a1d8e02bd5f7bac29f4fb

Score

10^/10

redline 1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

77.232.36.171:31078

Attributes

auth_value
9570c1130d94c3bb18e6065c4cf89298

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/384-54-0x00000000004B0000-0x00000000004E6000-memory.dmp	family_redline
behavioral1/memory/384-55-0x0000000002090000-0x00000000020C4000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

04875c48adccb44ffcb18af8ac581112.exe

pid process

384 04875c48adccb44ffcb18af8ac581112.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04875c48adccb44ffcb18af8ac581112.exe

description pid process

Token: SeDebugPrivilege 384 04875c48adccb44ffcb18af8ac581112.exe

pid	process
384	04875c48adccb44ffcb18af8ac581112.exe

description	pid	process
Token: SeDebugPrivilege	384	04875c48adccb44ffcb18af8ac581112.exe

C:\Users\Admin\AppData\Local\Temp\04875c48adccb44ffcb18af8ac581112.exe
"C:\Users\Admin\AppData\Local\Temp\04875c48adccb44ffcb18af8ac581112.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-54-0x00000000004B0000-0x00000000004E6000-memory.dmp

Filesize
216KB

Download
memory/384-55-0x0000000002090000-0x00000000020C4000-memory.dmp

Filesize
208KB

Download
memory/384-56-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/384-58-0x0000000000220000-0x000000000025A000-memory.dmp

Filesize
232KB

Download
memory/384-57-0x00000000005BE000-0x00000000005EA000-memory.dmp

Filesize
176KB

Download
memory/384-59-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download