redline | 5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33

General

Target

5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe
Size

407KB
MD5

7cae41020a46a1433c370536a4aef2f5
SHA1

5ffffcc209e69702b510383820bec50941c797c4
SHA256

5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33
SHA512

b7ba5ef62e0866847ef842ffd35fb0fdc8d0af99decc70a90ab01cddd4740525c020fdaa10bfae9feb9b0c92d74fbb2774e9c77bdb35d38513e3d5554111314f

Score

10^/10

redline test1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

185.215.113.75:80

Attributes

auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe

pid process

2484 5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe

description pid process

Token: SeDebugPrivilege 2484 5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe

pid	process
2484	5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe

description	pid	process
Token: SeDebugPrivilege	2484	5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe

C:\Users\Admin\AppData\Local\Temp\5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe
"C:\Users\Admin\AppData\Local\Temp\5622bf59698087881f5bef91a36bcc55e08082bf5973f72e209bf01bb5162b33.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-114-0x0000000002370000-0x00000000023A0000-memory.dmp

Filesize
192KB

Download
memory/2484-115-0x0000000000751000-0x000000000077B000-memory.dmp

Filesize
168KB

Download
memory/2484-116-0x0000000000700000-0x0000000000737000-memory.dmp

Filesize
220KB

Download
memory/2484-117-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2484-118-0x0000000004C30000-0x000000000512E000-memory.dmp

Filesize
5.0MB

Download
memory/2484-119-0x00000000025D0000-0x00000000025FE000-memory.dmp

Filesize
184KB

Download
memory/2484-120-0x0000000005130000-0x0000000005736000-memory.dmp

Filesize
6.0MB

Download
memory/2484-121-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/2484-122-0x0000000004B00000-0x0000000004C0A000-memory.dmp

Filesize
1.0MB

Download
memory/2484-123-0x0000000005740000-0x000000000577E000-memory.dmp

Filesize
248KB

Download
memory/2484-124-0x00000000057C0000-0x000000000580B000-memory.dmp

Filesize
300KB

Download
memory/2484-125-0x00000000066E0000-0x0000000006756000-memory.dmp

Filesize
472KB

Download
memory/2484-126-0x0000000006770000-0x0000000006802000-memory.dmp

Filesize
584KB

Download
memory/2484-127-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/2484-128-0x0000000006A60000-0x0000000006AC6000-memory.dmp

Filesize
408KB

Download
memory/2484-129-0x0000000006D60000-0x0000000006F22000-memory.dmp

Filesize
1.8MB

Download
memory/2484-130-0x0000000006F30000-0x000000000745C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing