redline | d0925c242a852d0d535a949e3142c2b775982f61ae1079cc7ae86e2a5abcfb8b

General

Target

Setup.exe
Size

669KB
MD5

b4878dcbd908cfa8f8713306819eb8e2
SHA1

f839f0f49b287fca721caa2af639f3ecaf445c79
SHA256

d0925c242a852d0d535a949e3142c2b775982f61ae1079cc7ae86e2a5abcfb8b
SHA512

15e105cb88e95a58aa630a4874d2ae1d3b7de41d01e9653e457cb0786e8b03908b4702d9af38d895a9d36298a5da6932143735a4a1935a82dc7263e633f66e6d

Score

10^/10

redline 76 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

76

C2

139.99.32.83:43199

Attributes

auth_value
44d461325298129ed3c705440f57962c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 3132 set thread context of 3164 3132 Setup.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3976 3132 WerFault.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

3164 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 3164 AppLaunch.exe

description	pid	process	target process
PID 3132 set thread context of 3164	3132	Setup.exe	AppLaunch.exe

pid	pid_target	process	target process
3976	3132	WerFault.exe	Setup.exe

pid	process
3164	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3164	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 3132 wrote to memory of 3164	3132	Setup.exe	AppLaunch.exe
PID 3132 wrote to memory of 3164	3132	Setup.exe	AppLaunch.exe
PID 3132 wrote to memory of 3164	3132	Setup.exe	AppLaunch.exe
PID 3132 wrote to memory of 3164	3132	Setup.exe	AppLaunch.exe
PID 3132 wrote to memory of 3164	3132	Setup.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 612
2⤵
- Program crash
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3132 -ip 3132
1⤵
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-130-0x0000000000000000-mapping.dmp

Download
memory/3164-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3164-136-0x00000000055A0000-0x0000000005BB8000-memory.dmp

Filesize
6.1MB

Download
memory/3164-137-0x0000000005010000-0x0000000005022000-memory.dmp

Filesize
72KB

Download
memory/3164-138-0x0000000005140000-0x000000000524A000-memory.dmp

Filesize
1.0MB

Download
memory/3164-139-0x0000000005070000-0x00000000050AC000-memory.dmp

Filesize
240KB

Download
memory/3164-140-0x00000000053A0000-0x0000000005416000-memory.dmp

Filesize
472KB

Download
memory/3164-141-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/3164-142-0x0000000006170000-0x0000000006714000-memory.dmp

Filesize
5.6MB

Download
memory/3164-143-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Filesize
120KB

Download
memory/3164-144-0x0000000005FD0000-0x0000000006036000-memory.dmp

Filesize
408KB

Download
memory/3164-145-0x00000000069B0000-0x0000000006A00000-memory.dmp

Filesize
320KB

Download
memory/3164-146-0x0000000006BD0000-0x0000000006D92000-memory.dmp

Filesize
1.8MB

Download
memory/3164-147-0x00000000072D0000-0x00000000077FC000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing