redline | 6b313fae80a9226c4293f5b5bb57129f1bc4f2a8c46bdabb7a577a08e47672b9

General

Target

setup/AISetup-Crack.exe
Size

2.4MB
MD5

be7879386bb4db5b6c8415166db67ef8
SHA1

ddd3021057a36b9f3298abc2844c3905652a9429
SHA256

9871a54a96e578971bde616e6110d08c60d1644734f72358ef04885d16c73d99
SHA512

4b0d06d882df5badbcd6d4445f8d3d4fc4db1fe7ec87018c316e9a0cf49e3e04c9c1459150d18613e5af0327b42d7f42a3eef174e35af6a436d2b903373bd9cc

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-56-0x0000000000810000-0x0000000000A4D000-memory.dmp	family_redline
behavioral1/memory/1968-57-0x0000000000810000-0x0000000000A4D000-memory.dmp	family_redline
behavioral1/memory/1968-63-0x0000000000810000-0x0000000000A4D000-memory.dmp	family_redline
behavioral1/memory/1968-67-0x0000000000810000-0x0000000000A4D000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AISetup-Crack.exe

description pid process

Token: SeDebugPrivilege 1968 AISetup-Crack.exe

description	pid	process
Token: SeDebugPrivilege	1968	AISetup-Crack.exe

C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe
"C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000074EA0000-0x0000000074EEA000-memory.dmp

Filesize
296KB

Download
memory/1968-56-0x0000000000810000-0x0000000000A4D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-57-0x0000000000810000-0x0000000000A4D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-59-0x0000000075730000-0x00000000757DC000-memory.dmp

Filesize
688KB

Download
memory/1968-60-0x00000000757E0000-0x0000000075827000-memory.dmp

Filesize
284KB

Download
memory/1968-61-0x0000000075480000-0x00000000754D7000-memory.dmp

Filesize
348KB

Download
memory/1968-62-0x0000000000100000-0x0000000000141000-memory.dmp

Filesize
260KB

Download
memory/1968-63-0x0000000000810000-0x0000000000A4D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-64-0x00000000757E0000-0x0000000075827000-memory.dmp

Filesize
284KB

Download
memory/1968-66-0x0000000076190000-0x00000000762EC000-memory.dmp

Filesize
1.4MB

Download
memory/1968-67-0x0000000000810000-0x0000000000A4D000-memory.dmp

Filesize
2.2MB

Download
memory/1968-68-0x0000000077140000-0x00000000771CF000-memory.dmp

Filesize
572KB

Download
memory/1968-70-0x00000000764C0000-0x000000007710A000-memory.dmp

Filesize
12.3MB

Download
memory/1968-71-0x00000000739A0000-0x00000000739B7000-memory.dmp

Filesize
92KB

Download
memory/1968-72-0x0000000075E20000-0x0000000075E55000-memory.dmp

Filesize
212KB

Download
memory/1968-73-0x000000006CF10000-0x000000006D0A0000-memory.dmp

Filesize
1.6MB

Download
memory/1968-74-0x000000006AD20000-0x000000006AD37000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing