redline | 194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8

Analysis

max time kernel
52s
max time network
54s
platform
windows10_x64
resource
win10-20220414-en
submitted
21-05-2022 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe
Size

416KB
MD5

d32413bbfc52ec23d1d28be9162a8f39
SHA1

64e5eeb5e1e873bd0f2ec9b89ff56db0c312d842
SHA256

194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8
SHA512

66401b51a2b8c7cfdde474f38388f61df5162e810c13a1c0138006007ef3aa559c266a0d225c73714545cea4c52fb502b17a2dfb8a7346fe8800cd9c8332b43e

Score

10^/10

redline ruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Ruzki

193.233.48.58:38989

Attributes

auth_value
80c38cc7772c328c028b0e4f42a3fac6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1312-159-0x0000000002200000-0x0000000002234000-memory.dmp	family_redline
behavioral1/memory/1312-166-0x00000000024A0000-0x00000000024D4000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe

description pid process

Token: SeDebugPrivilege 1312 194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe

description	pid	process
Token: SeDebugPrivilege	1312	194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe

C:\Users\Admin\AppData\Local\Temp\194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe
"C:\Users\Admin\AppData\Local\Temp\194c47ca1824071873b16ed49e373f5109ced8eedc694dbbca5878a02cac16c8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-115-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-116-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-117-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-118-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-119-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-120-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-121-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-123-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-124-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-125-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-126-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-127-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-128-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-129-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-130-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-131-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-132-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-133-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-134-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-135-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-136-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-137-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-138-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-139-0x00000000005E0000-0x000000000072A000-memory.dmp

Filesize
1.3MB

Download
memory/1312-140-0x00000000005E0000-0x000000000072A000-memory.dmp

Filesize
1.3MB

Download
memory/1312-141-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-142-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-143-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-144-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-145-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-146-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-147-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-148-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-149-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1312-150-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-151-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-152-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-153-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-154-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-155-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-156-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-157-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-158-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-159-0x0000000002200000-0x0000000002234000-memory.dmp

Filesize
208KB

Download
memory/1312-160-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-161-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-162-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-163-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-164-0x0000000004D10000-0x000000000520E000-memory.dmp

Filesize
5.0MB

Download
memory/1312-165-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-166-0x00000000024A0000-0x00000000024D4000-memory.dmp

Filesize
208KB

Download
memory/1312-167-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-168-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-169-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-170-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-171-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-172-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-173-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-174-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-175-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-176-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-177-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-178-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-179-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-180-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-181-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-182-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-183-0x0000000005210000-0x0000000005816000-memory.dmp

Filesize
6.0MB

Download
memory/1312-184-0x00000000025A0000-0x00000000025B2000-memory.dmp

Filesize
72KB

Download
memory/1312-185-0x0000000004B70000-0x0000000004C7A000-memory.dmp

Filesize
1.0MB

Download
memory/1312-186-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-187-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-188-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/1312-189-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-190-0x0000000005820000-0x000000000586B000-memory.dmp

Filesize
300KB

Download
memory/1312-194-0x0000000005A70000-0x0000000005AE6000-memory.dmp

Filesize
472KB

Download
memory/1312-195-0x0000000005AF0000-0x0000000005B82000-memory.dmp

Filesize
584KB

Download
memory/1312-198-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Filesize
120KB

Download
memory/1312-200-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Filesize
408KB

Download
memory/1312-208-0x0000000006480000-0x0000000006642000-memory.dmp

Filesize
1.8MB

Download
memory/1312-209-0x0000000006650000-0x0000000006B7C000-memory.dmp

Filesize
5.2MB

Download