redline | 24bde190edd5fda4b47d376abef29d385d655c11ccfdeb314ffced065675cad4

General

Target

MVPInstaller.exe
Size

255KB
MD5

883eb374a6710283bab49bd840d911c7
SHA1

29416739657f2d2b7a900dca6ddeda755852818e
SHA256

24bde190edd5fda4b47d376abef29d385d655c11ccfdeb314ffced065675cad4
SHA512

b2a159e495624cee478be7d3ff409c9d89eb6e8cb021904ab302df4910874013a305ea10100fae12685d8fc0694d84c553e4f61a194498fd0d5ee2bf6cc5527d

Score

10^/10

redline 1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

116.202.19.253:30602

Attributes

auth_value
da0d7d77d8ec04c55cc5ace3d9113a5c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

MVPInstaller.exe

description pid process target process

PID 2580 set thread context of 3800 2580 MVPInstaller.exe MVPInstaller.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

MVPInstaller.exeMVPInstaller.exe

pid process

2580 MVPInstaller.exe
2580 MVPInstaller.exe
3800 MVPInstaller.exe
3800 MVPInstaller.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MVPInstaller.exeMVPInstaller.exe

description pid process

Token: SeDebugPrivilege 2580 MVPInstaller.exe
Token: SeDebugPrivilege 3800 MVPInstaller.exe

description	pid	process	target process
PID 2580 set thread context of 3800	2580	MVPInstaller.exe	MVPInstaller.exe

pid	process
2580	MVPInstaller.exe
2580	MVPInstaller.exe
3800	MVPInstaller.exe
3800	MVPInstaller.exe

description	pid	process
Token: SeDebugPrivilege	2580	MVPInstaller.exe
Token: SeDebugPrivilege	3800	MVPInstaller.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

MVPInstaller.exe

description	pid	process	target process
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe
PID 2580 wrote to memory of 3800	2580	MVPInstaller.exe	MVPInstaller.exe

C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MVPInstaller.exe.log
Filesize
1KB

MD5
df27a876383bd81dfbcb457a9fa9f09d

SHA1
1bbc4ab95c89d02ec1d217f0255205787999164e

SHA256
8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

SHA512
fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

Download Submit
memory/2580-131-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/2580-132-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/2580-133-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/2580-130-0x0000000000E50000-0x0000000000E92000-memory.dmp

Filesize
264KB

Download
memory/3800-138-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

Filesize
72KB

Download
memory/3800-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3800-137-0x0000000005270000-0x0000000005888000-memory.dmp

Filesize
6.1MB

Download
memory/3800-134-0x0000000000000000-mapping.dmp

Download
memory/3800-139-0x0000000004E10000-0x0000000004F1A000-memory.dmp

Filesize
1.0MB

Download
memory/3800-140-0x0000000004D40000-0x0000000004D7C000-memory.dmp

Filesize
240KB

Download
memory/3800-141-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/3800-142-0x0000000005D10000-0x0000000005D86000-memory.dmp

Filesize
472KB

Download
memory/3800-143-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/3800-144-0x0000000007570000-0x0000000007732000-memory.dmp

Filesize
1.8MB

Download
memory/3800-145-0x0000000007C70000-0x000000000819C000-memory.dmp

Filesize
5.2MB

Download
memory/3800-146-0x0000000006840000-0x0000000006890000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing