redline | 642bf61f9656120b91dbf8bc03a404e0dad352de35f472a646609c1721f3cdfe

General

Target

_@vasyapupkin198_crypted.exe
Size

2.4MB
MD5

1017e8c87e171726d22c64c7ea74c127
SHA1

2ab6e439c75a7dd6848834c7a648cec91731f568
SHA256

642bf61f9656120b91dbf8bc03a404e0dad352de35f472a646609c1721f3cdfe
SHA512

3d1a1805622a5fb449030f4ef5a568655e78b5b1f3cb29a25df211effca05c29c366088a530f00c96774088e4ca90116831ef9077ba979467df5462baf1ce7b4

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

C2

185.215.113.83:60722

Attributes

auth_value
9b369b35de96e42580e664d13a1927dc

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/213228-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/213228-61-0x000000000041B4EE-mapping.dmp	family_redline
behavioral1/memory/213228-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/213228-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

_@vasyapupkin198_crypted.exe

description pid process target process

PID 1892 set thread context of 213228 1892 _@vasyapupkin198_crypted.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

213228 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 213228 AppLaunch.exe

description	pid	process	target process
PID 1892 set thread context of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe

pid	process
213228	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	213228	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

_@vasyapupkin198_crypted.exe

description	pid	process	target process
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe
PID 1892 wrote to memory of 213228	1892	_@vasyapupkin198_crypted.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\_@vasyapupkin198_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\_@vasyapupkin198_crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:213228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/213228-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213228-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213228-61-0x000000000041B4EE-mapping.dmp

Download
memory/213228-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213228-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/213228-64-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing