redline | 158e17bf5074a1e8e04d1f76adb1b19991e8646be719149bc2f3c93300ab544c

General

Target

Setup.exe
Size

2.5MB
MD5

692bb5c0a6be51f599fc7c89b54ed533
SHA1

6ecc3892d959822a7a5d4803f665d4407e70dbe1
SHA256

158e17bf5074a1e8e04d1f76adb1b19991e8646be719149bc2f3c93300ab544c
SHA512

a79cd83a17532ab4bdd458cc4b5c997a57de6d65708bb01bec1e133040ad9870303a259442c9b7e3fffc8c45ea97da07c9f1b802f9361203af4ac28b414f6450

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

193.106.191.160:8673

Attributes

auth_value
6988f8340a66b40e87fa1375bd2f916c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/197028-131-0x0000000000340000-0x0000000000360000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/1584-152-0x0000000000F60000-0x0000000001D38000-memory.dmp	family_ytstealer
behavioral2/memory/1584-155-0x0000000000F60000-0x0000000001D38000-memory.dmp	family_ytstealer

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1584	yu.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0010000000022f2f-150.dat	upx
behavioral2/files/0x0010000000022f2f-149.dat	upx
behavioral2/memory/1584-151-0x0000000000F60000-0x0000000001D38000-memory.dmp	upx
behavioral2/memory/1584-152-0x0000000000F60000-0x0000000001D38000-memory.dmp	upx
behavioral2/memory/1584-155-0x0000000000F60000-0x0000000001D38000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 197028	1440	Setup.exe	83

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
197028	AppLaunch.exe
1584	yu.exe
1584	yu.exe
1584	yu.exe
1584	yu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	197028	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 197028	1440	Setup.exe	83
PID 1440 wrote to memory of 197028	1440	Setup.exe	83
PID 1440 wrote to memory of 197028	1440	Setup.exe	83
PID 1440 wrote to memory of 197028	1440	Setup.exe	83
PID 1440 wrote to memory of 197028	1440	Setup.exe	83
PID 197028 wrote to memory of 1584	197028	AppLaunch.exe	91
PID 197028 wrote to memory of 1584	197028	AppLaunch.exe	91
PID 1584 wrote to memory of 3416	1584	yu.exe	93
PID 1584 wrote to memory of 3416	1584	yu.exe	93
PID 3416 wrote to memory of 2628	3416	cmd.exe	95
PID 3416 wrote to memory of 2628	3416	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:197028
- - C:\Users\Admin\AppData\Roaming\yu.exe
    "C:\Users\Admin\AppData\Roaming\yu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Roaming\yu.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\yu.exe

Filesize
4.0MB

MD5
da70d0aab8cad0887e5e9b5174c9d87d

SHA1
af5096c0b9fd4f4926850c4479c8e0e0eac8c91b

SHA256
6617c1ab08b88711538b600fc4c5cf76098088b436185f5590cdb0e1fc1f6b13

SHA512
c100a08bccfa00dcf93160b6174940db1b6839aafbbaec8caa25c4c0e004c96aebf243552df85b7dff56915401bfcb0ecb9caa9bce2edf0d29a9b52c849ebcc5

Download Submit
C:\Users\Admin\AppData\Roaming\yu.exe

Filesize
4.0MB

MD5
da70d0aab8cad0887e5e9b5174c9d87d

SHA1
af5096c0b9fd4f4926850c4479c8e0e0eac8c91b

SHA256
6617c1ab08b88711538b600fc4c5cf76098088b436185f5590cdb0e1fc1f6b13

SHA512
c100a08bccfa00dcf93160b6174940db1b6839aafbbaec8caa25c4c0e004c96aebf243552df85b7dff56915401bfcb0ecb9caa9bce2edf0d29a9b52c849ebcc5

Download Submit
memory/1584-155-0x0000000000F60000-0x0000000001D38000-memory.dmp

Filesize
13.8MB

Download
memory/1584-152-0x0000000000F60000-0x0000000001D38000-memory.dmp

Filesize
13.8MB

Download
memory/1584-151-0x0000000000F60000-0x0000000001D38000-memory.dmp

Filesize
13.8MB

Download
memory/197028-139-0x0000000004C70000-0x0000000004CAC000-memory.dmp

Filesize
240KB

Download
memory/197028-141-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/197028-144-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/197028-145-0x0000000006730000-0x0000000006780000-memory.dmp

Filesize
320KB

Download
memory/197028-146-0x0000000007600000-0x00000000077C2000-memory.dmp

Filesize
1.8MB

Download
memory/197028-147-0x0000000007D00000-0x000000000822C000-memory.dmp

Filesize
5.2MB

Download
memory/197028-142-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/197028-143-0x00000000058C0000-0x00000000058DE000-memory.dmp

Filesize
120KB

Download
memory/197028-140-0x0000000004FB0000-0x0000000005026000-memory.dmp

Filesize
472KB

Download
memory/197028-138-0x0000000004D40000-0x0000000004E4A000-memory.dmp

Filesize
1.0MB

Download
memory/197028-137-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/197028-136-0x00000000051A0000-0x00000000057B8000-memory.dmp

Filesize
6.1MB

Download
memory/197028-131-0x0000000000340000-0x0000000000360000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing