redline | 87a643f05a4a942da305e22222193770bee9ecee4f7f0442408445336bf1c8ef

General

Target

e01e4ebdceade8f7f9e29a3c8bceb7a9.exe
Size

334KB
MD5

e01e4ebdceade8f7f9e29a3c8bceb7a9
SHA1

f531072ea44f2ddbff5670b9c47030a235aaa97b
SHA256

87a643f05a4a942da305e22222193770bee9ecee4f7f0442408445336bf1c8ef
SHA512

4f4d3b40c3efe5eebd5c472f15df0ec3f340b132b22f982085d5c617071f3548871f349268ba7c7c9584c37456aa54c8104ecc8c9d4aa45c7f535f64b6815170

Score

10^/10

redline top discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

top

C2

185.215.113.75:81

Attributes

auth_value
ff6259bc2baf33b54b454aad484fb0ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e01e4ebdceade8f7f9e29a3c8bceb7a9.exe

pid process

2024 e01e4ebdceade8f7f9e29a3c8bceb7a9.exe
2024 e01e4ebdceade8f7f9e29a3c8bceb7a9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e01e4ebdceade8f7f9e29a3c8bceb7a9.exe

description pid process

Token: SeDebugPrivilege 2024 e01e4ebdceade8f7f9e29a3c8bceb7a9.exe

pid	process
2024	e01e4ebdceade8f7f9e29a3c8bceb7a9.exe
2024	e01e4ebdceade8f7f9e29a3c8bceb7a9.exe

description	pid	process
Token: SeDebugPrivilege	2024	e01e4ebdceade8f7f9e29a3c8bceb7a9.exe

C:\Users\Admin\AppData\Local\Temp\e01e4ebdceade8f7f9e29a3c8bceb7a9.exe
"C:\Users\Admin\AppData\Local\Temp\e01e4ebdceade8f7f9e29a3c8bceb7a9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-55-0x0000000000220000-0x0000000000257000-memory.dmp

Filesize
220KB

Download
memory/2024-54-0x0000000000A9E000-0x0000000000AC8000-memory.dmp

Filesize
168KB

Download
memory/2024-56-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/2024-57-0x0000000000CC0000-0x0000000000CF0000-memory.dmp

Filesize
192KB

Download
memory/2024-58-0x0000000002520000-0x000000000254E000-memory.dmp

Filesize
184KB

Download
memory/2024-59-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/2024-60-0x0000000072A40000-0x0000000073DCF000-memory.dmp

Filesize
19.6MB

Download
memory/2024-61-0x0000000072030000-0x0000000072A40000-memory.dmp

Filesize
10.1MB

Download
memory/2024-62-0x0000000074580000-0x0000000074714000-memory.dmp

Filesize
1.6MB

Download
memory/2024-63-0x0000000071310000-0x000000007202D000-memory.dmp

Filesize
13.1MB

Download
memory/2024-64-0x0000000070B30000-0x0000000071310000-memory.dmp

Filesize
7.9MB

Download
memory/2024-65-0x000000006F820000-0x0000000070B2F000-memory.dmp

Filesize
19.1MB

Download
memory/2024-66-0x0000000074260000-0x0000000074548000-memory.dmp

Filesize
2.9MB

Download
memory/2024-67-0x000000006F560000-0x000000006F81B000-memory.dmp

Filesize
2.7MB

Download
memory/2024-68-0x0000000074240000-0x0000000074260000-memory.dmp

Filesize
128KB

Download
memory/2024-69-0x000000006EE20000-0x000000006F55E000-memory.dmp

Filesize
7.2MB

Download
memory/2024-70-0x0000000074170000-0x0000000074239000-memory.dmp

Filesize
804KB

Download
memory/2024-71-0x0000000074070000-0x000000007416C000-memory.dmp

Filesize
1008KB

Download
memory/2024-72-0x000000006E900000-0x000000006EA8B000-memory.dmp

Filesize
1.5MB

Download
memory/2024-73-0x000000006E700000-0x000000006E763000-memory.dmp

Filesize
396KB

Download
memory/2024-74-0x000000006E5D0000-0x000000006E6F3000-memory.dmp

Filesize
1.1MB

Download
memory/2024-75-0x000000006D6E0000-0x000000006E436000-memory.dmp

Filesize
13.3MB

Download
memory/2024-76-0x000000006D3C0000-0x000000006D6DB000-memory.dmp

Filesize
3.1MB

Download
memory/2024-77-0x0000000000A9E000-0x0000000000AC8000-memory.dmp

Filesize
168KB

Download
memory/2024-78-0x0000000072A40000-0x0000000073DCF000-memory.dmp

Filesize
19.6MB

Download
memory/2024-79-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/2024-80-0x0000000072030000-0x0000000072A40000-memory.dmp

Filesize
10.1MB

Download
memory/2024-81-0x000000006D6E0000-0x000000006E436000-memory.dmp

Filesize
13.3MB

Download
memory/2024-82-0x0000000074580000-0x0000000074714000-memory.dmp

Filesize
1.6MB

Download
memory/2024-83-0x0000000071310000-0x000000007202D000-memory.dmp

Filesize
13.1MB

Download
memory/2024-84-0x0000000070B30000-0x0000000071310000-memory.dmp

Filesize
7.9MB

Download
memory/2024-85-0x000000006F820000-0x0000000070B2F000-memory.dmp

Filesize
19.1MB

Download
memory/2024-86-0x000000006F560000-0x000000006F81B000-memory.dmp

Filesize
2.7MB

Download
memory/2024-88-0x0000000074170000-0x0000000074239000-memory.dmp

Filesize
804KB

Download
memory/2024-87-0x000000006EE20000-0x000000006F55E000-memory.dmp

Filesize
7.2MB

Download
memory/2024-89-0x000000006E5D0000-0x000000006E6F3000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing