redline | e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d

General

Target

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe
Size

506KB
MD5

bbe853da213fd6b783a08eafc2d4cad0
SHA1

45cdd1c02bc98e86073f4ab3caa2b034b29c98ad
SHA256

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d
SHA512

04505ac1afeed23d9495eb3a63838b371e541272da0daf0359229a2a5e18532928047f46e59d1acd55d3e78d0fb9e0226a87cda20ae5c47a15bdc047bf26da4f

Score

10^/10

redline tpb-activator discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

TPB-ACTIVATOR

C2

amrican-sport-live-stream.cc:4581

Attributes

auth_value
df7c91432437b11d8f25d54ba7832b8d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1248-138-0x0000000000400000-0x0000000000444000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe

description	pid	process	target process
PID 3432 set thread context of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exeRegAsm.exe

pid	process
3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe
3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe
1248	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe
Token: SeDebugPrivilege	1248	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe

description	pid	process	target process
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe
PID 3432 wrote to memory of 1248	3432	e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe
"C:\Users\Admin\AppData\Local\Temp\e0651a5be1a28da97d1054c8542c0b9b0b734e05c67d7c2da49123d52e24e32d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-144-0x000000000B850000-0x000000000B86E000-memory.dmp

Filesize
120KB

Download
memory/1248-138-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1248-147-0x000000000D6C0000-0x000000000DBEC000-memory.dmp

Filesize
5.2MB

Download
memory/1248-146-0x000000000CFC0000-0x000000000D182000-memory.dmp

Filesize
1.8MB

Download
memory/1248-140-0x000000000AA40000-0x000000000AA52000-memory.dmp

Filesize
72KB

Download
memory/1248-137-0x0000000000000000-mapping.dmp

Download
memory/1248-145-0x000000000C2C0000-0x000000000C310000-memory.dmp

Filesize
320KB

Download
memory/1248-139-0x000000000AFF0000-0x000000000B608000-memory.dmp

Filesize
6.1MB

Download
memory/1248-143-0x000000000AE00000-0x000000000AE76000-memory.dmp

Filesize
472KB

Download
memory/1248-141-0x000000000AB70000-0x000000000AC7A000-memory.dmp

Filesize
1.0MB

Download
memory/1248-142-0x000000000AAA0000-0x000000000AADC000-memory.dmp

Filesize
240KB

Download
memory/3432-136-0x0000000032EB0000-0x0000000033454000-memory.dmp

Filesize
5.6MB

Download
memory/3432-132-0x0000000000210000-0x0000000000294000-memory.dmp

Filesize
528KB

Download
memory/3432-133-0x0000000004D50000-0x0000000004D72000-memory.dmp

Filesize
136KB

Download
memory/3432-135-0x0000000032860000-0x00000000328F2000-memory.dmp

Filesize
584KB

Download
memory/3432-134-0x0000000032120000-0x0000000032186000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads