redline | cad1b58e38cfc1e0a0431fa9aae253a1626b4e4e3a6cbc6a8f119cd4959f6410

General

Target

859e6cf84ff73e9a9921fb829c3a386e.exe
Size

777KB
MD5

859e6cf84ff73e9a9921fb829c3a386e
SHA1

5bbc936fdb82ed3e57c1ae2f4a0cbfab459883b7
SHA256

cad1b58e38cfc1e0a0431fa9aae253a1626b4e4e3a6cbc6a8f119cd4959f6410
SHA512

bae39f648487e4ac364152cf18061d28d834f11ea27027075ebc41508d0850fd5416b0fcfdfedbc66afc4c734bb969625046cb8f18523e437f49fb6edecc1a4c

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1756-56-0x00000000012F0000-0x0000000001396000-memory.dmp	family_redline
behavioral1/memory/1756-57-0x00000000012F0000-0x0000000001396000-memory.dmp	family_redline
behavioral1/memory/1756-64-0x00000000012F0000-0x0000000001396000-memory.dmp	family_redline
behavioral1/memory/1756-69-0x00000000012F0000-0x0000000001396000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

859e6cf84ff73e9a9921fb829c3a386e.exe

pid process

1756 859e6cf84ff73e9a9921fb829c3a386e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

859e6cf84ff73e9a9921fb829c3a386e.exe

description pid process

Token: SeDebugPrivilege 1756 859e6cf84ff73e9a9921fb829c3a386e.exe

pid	process
1756	859e6cf84ff73e9a9921fb829c3a386e.exe

description	pid	process
Token: SeDebugPrivilege	1756	859e6cf84ff73e9a9921fb829c3a386e.exe

C:\Users\Admin\AppData\Local\Temp\859e6cf84ff73e9a9921fb829c3a386e.exe
"C:\Users\Admin\AppData\Local\Temp\859e6cf84ff73e9a9921fb829c3a386e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x0000000074DE0000-0x0000000074E2A000-memory.dmp

Filesize
296KB

Download
memory/1756-56-0x00000000012F0000-0x0000000001396000-memory.dmp

Filesize
664KB

Download
memory/1756-57-0x00000000012F0000-0x0000000001396000-memory.dmp

Filesize
664KB

Download
memory/1756-59-0x00000000764F0000-0x000000007659C000-memory.dmp

Filesize
688KB

Download
memory/1756-60-0x0000000076D40000-0x0000000076D87000-memory.dmp

Filesize
284KB

Download
memory/1756-61-0x0000000077080000-0x00000000770D7000-memory.dmp

Filesize
348KB

Download
memory/1756-63-0x0000000074F60000-0x00000000750BC000-memory.dmp

Filesize
1.4MB

Download
memory/1756-64-0x00000000012F0000-0x0000000001396000-memory.dmp

Filesize
664KB

Download
memory/1756-65-0x0000000076FF0000-0x000000007707F000-memory.dmp

Filesize
572KB

Download
memory/1756-66-0x0000000074C20000-0x0000000074CA0000-memory.dmp

Filesize
512KB

Download
memory/1756-68-0x0000000000140000-0x0000000000183000-memory.dmp

Filesize
268KB

Download
memory/1756-69-0x00000000012F0000-0x0000000001396000-memory.dmp

Filesize
664KB

Download
memory/1756-70-0x0000000076D40000-0x0000000076D87000-memory.dmp

Filesize
284KB

Download
memory/1756-67-0x00000000750C0000-0x0000000075D0A000-memory.dmp

Filesize
12.3MB

Download
memory/1756-71-0x000000006D1F0000-0x000000006D207000-memory.dmp

Filesize
92KB

Download
memory/1756-72-0x00000000769B0000-0x00000000769E5000-memory.dmp

Filesize
212KB

Download
memory/1756-73-0x000000006BCE0000-0x000000006BE70000-memory.dmp

Filesize
1.6MB

Download
memory/1756-74-0x000000006A920000-0x000000006A937000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing