redline | a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f

General

Target

a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe
Size

290KB
MD5

4a64f2d33923c007c5f2cd9a964eb35c
SHA1

9f95d5b12fa3e3eb742b1c7115c395884fd9c5bf
SHA256

a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f
SHA512

3cae084ff3ea61d054812942a5d66f7471055ff788ec6f4d499ad86ebd430e93c9dd576ac5611c139d4269e9431278ec07ade20ebb1fa4aef1e6a95064e92213

Score

10^/10

redline 9-5 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

9-5

C2

139.99.32.83:43199

Attributes

auth_value
637de2b47f42d9cc7912f71cb6b57b5b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-131-0x0000000000430000-0x0000000000450000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe

description	pid	process	target process
PID 1736 set thread context of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2372	1736	WerFault.exe	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe
3296	1736	WerFault.exe	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

1912 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1912 AppLaunch.exe

pid	process
1912	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1912	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe

description	pid	process	target process
PID 1736 wrote to memory of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe
PID 1736 wrote to memory of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe
PID 1736 wrote to memory of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe
PID 1736 wrote to memory of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe
PID 1736 wrote to memory of 1912	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	AppLaunch.exe
PID 1736 wrote to memory of 2372	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	WerFault.exe
PID 1736 wrote to memory of 2372	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	WerFault.exe
PID 1736 wrote to memory of 2372	1736	a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe
"C:\Users\Admin\AppData\Local\Temp\a43e06bcb221f023a05ecd2dffc305cab8ccd8ef9437746237047f67dbcdfb0f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 296
2⤵
- Program crash
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 296
2⤵
- Program crash
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1736 -ip 1736
1⤵
PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-140-0x0000000006FD0000-0x000000000700C000-memory.dmp

Filesize
240KB

Download
memory/1912-142-0x0000000007BE0000-0x0000000007C72000-memory.dmp

Filesize
584KB

Download
memory/1912-148-0x0000000008770000-0x00000000087C0000-memory.dmp

Filesize
320KB

Download
memory/1912-137-0x00000000056E0000-0x0000000005CF8000-memory.dmp

Filesize
6.1MB

Download
memory/1912-138-0x0000000006F60000-0x0000000006F72000-memory.dmp

Filesize
72KB

Download
memory/1912-139-0x0000000007090000-0x000000000719A000-memory.dmp

Filesize
1.0MB

Download
memory/1912-131-0x0000000000430000-0x0000000000450000-memory.dmp

Filesize
128KB

Download
memory/1912-141-0x00000000080B0000-0x0000000008654000-memory.dmp

Filesize
5.6MB

Download
memory/1912-130-0x0000000000000000-mapping.dmp

Download
memory/1912-143-0x0000000007C80000-0x0000000007CE6000-memory.dmp

Filesize
408KB

Download
memory/1912-144-0x0000000007CF0000-0x0000000007D66000-memory.dmp

Filesize
472KB

Download
memory/1912-145-0x0000000007ED0000-0x0000000007EEE000-memory.dmp

Filesize
120KB

Download
memory/1912-146-0x0000000008830000-0x00000000089F2000-memory.dmp

Filesize
1.8MB

Download
memory/1912-147-0x0000000008F30000-0x000000000945C000-memory.dmp

Filesize
5.2MB

Download
memory/2372-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads