redline | 466d8ee83aa0e9197e9135b845fab890eb7ca3ad04c9060404cd9a25ab844600

General

Target

0f679420cfdca278cc906fe0304a14cd.exe
Size

2.4MB
MD5

0f679420cfdca278cc906fe0304a14cd
SHA1

5e64da534eaeee4dbae4591a1fd10d0e9e7134b6
SHA256

466d8ee83aa0e9197e9135b845fab890eb7ca3ad04c9060404cd9a25ab844600
SHA512

f0373469f21631651eb557e80e076231b3f58ab0473f7b87747d473858c2d25b2d81c14b4d49741a544d8b321cd963f6a6f35f425ef5890eda68e4de88944110

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

C2

213.226.123.155:2014

Attributes

auth_value
acc89c018dd09af2c4427effeca07a04

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/213252-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/213252-61-0x000000000041B4CE-mapping.dmp	family_redline
behavioral1/memory/213252-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/213252-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

Installer.exe

pid process

213536 Installer.exe
Loads dropped DLL 1 IoCs

Processes:

AppLaunch.exe

pid process

213252 AppLaunch.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

0f679420cfdca278cc906fe0304a14cd.exe

description pid process target process

PID 948 set thread context of 213252 948 0f679420cfdca278cc906fe0304a14cd.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exeInstaller.exe

pid process

213252 AppLaunch.exe
213536 Installer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AppLaunch.exeInstaller.exe

description pid process

Token: SeDebugPrivilege 213252 AppLaunch.exe
Token: SeDebugPrivilege 213536 Installer.exe

pid	process
213536	Installer.exe

pid	process
213252	AppLaunch.exe

description	pid	process	target process
PID 948 set thread context of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe

pid	process
213252	AppLaunch.exe
213536	Installer.exe

description	pid	process
Token: SeDebugPrivilege	213252	AppLaunch.exe
Token: SeDebugPrivilege	213536	Installer.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

0f679420cfdca278cc906fe0304a14cd.exeAppLaunch.exe

description	pid	process	target process
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 948 wrote to memory of 213252	948	0f679420cfdca278cc906fe0304a14cd.exe	AppLaunch.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe
PID 213252 wrote to memory of 213536	213252	AppLaunch.exe	Installer.exe

C:\Users\Admin\AppData\Local\Temp\0f679420cfdca278cc906fe0304a14cd.exe
"C:\Users\Admin\AppData\Local\Temp\0f679420cfdca278cc906fe0304a14cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:213252

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:213536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Installer.exe
Filesize
82KB

MD5
0759cd1397dbd963689019c7ef994df8

SHA1
b9c0f77040e2ed3065329aa89f7420e68fef6194

SHA256
42fbf11d75c5fa3895a269c62e0a23d8cc6856bef6a36c2dce81deac589b286a

SHA512
10996b4f98af36456b9f41a488711854123b776d5b130f8db48d9589ea7e5cccde2d7f0eabaf00f7e201dbf52878dbc1c29242f9f35acb4e6f59b80862e83331

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installer.exe
Filesize
82KB

MD5
0759cd1397dbd963689019c7ef994df8

SHA1
b9c0f77040e2ed3065329aa89f7420e68fef6194

SHA256
42fbf11d75c5fa3895a269c62e0a23d8cc6856bef6a36c2dce81deac589b286a

SHA512
10996b4f98af36456b9f41a488711854123b776d5b130f8db48d9589ea7e5cccde2d7f0eabaf00f7e201dbf52878dbc1c29242f9f35acb4e6f59b80862e83331

Download Submit
\Users\Admin\AppData\Local\Temp\Installer.exe
Filesize
82KB

MD5
0759cd1397dbd963689019c7ef994df8

SHA1
b9c0f77040e2ed3065329aa89f7420e68fef6194

SHA256
42fbf11d75c5fa3895a269c62e0a23d8cc6856bef6a36c2dce81deac589b286a

SHA512
10996b4f98af36456b9f41a488711854123b776d5b130f8db48d9589ea7e5cccde2d7f0eabaf00f7e201dbf52878dbc1c29242f9f35acb4e6f59b80862e83331

Download Submit
memory/213252-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213252-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213252-61-0x000000000041B4CE-mapping.dmp

Download
memory/213252-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213252-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213252-64-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/213536-66-0x0000000000000000-mapping.dmp

Download
memory/213536-70-0x0000000001240000-0x000000000125E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing