redline | 7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc

General

Target
7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
Size 1.2MB
Sample220520-hqcdkshgcj
SHA256 7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc
MD5 b73d13d32f9df6b00d0a6e963787e0fc
SHA1 a9eaf1f29c10b27c43e81676492b365afd409836
SHA512 60fc768b11ffe5ab7494417c4a17654c56455246d8f451670b8890b3bc7a6de6eeac78a8728ca78b9192d2cc8063132d28bb1606be70f6e166240b4fc675e128
MD5 SHA1 SHA512

Score

10^/10

redline 2013582782 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

2013582782

C2

193.106.191.253:4752

Attributes

auth_value
17de503b57a83628c6c41512f6c8b2bc

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2044-65-0x0000000000420000-0x0000000000440000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
2044	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2032	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	28
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29
PID 916 wrote to memory of 2044	916	7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe	29

C:\Users\Admin\AppData\Local\Temp\7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe
"C:\Users\Admin\AppData\Local\Temp\7685986b1e5d757916fbb0e878a8668d6ebae4b869e62770307c1bfb07eafdcc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-54-0x00000000023C0000-0x0000000002509000-memory.dmp

Download

memory/916-55-0x00000000023C0000-0x0000000002509000-memory.dmp

Download

memory/916-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

memory/916-57-0x000000000F660000-0x000000000F7A7000-memory.dmp

Download

memory/2044-58-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2044-60-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2044-62-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2044-64-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2044-65-0x0000000000420000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads