Overview

overview

10

Static

static

10

1668-55-0x...ry.exe

windows7-x64

10

1668-55-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1668-55-0x0000000000370000-0x0000000000390000-memory.dmp

  • Size

    128KB

  • Sample

    220810-nnkvtshfgq

  • MD5

    87615e1a3f408e63259116083fad6392

  • SHA1

    1a3688ef0f2cb1ef9c1963a93c2eadeba8f734d1

  • SHA256

    52066c6ca336690c58b365ec147e4e00bb22db315a3890cfd3626921821f1abe

  • SHA512

    771e0006f1fc72fe7e1e3c8bff2f4359cb83d6797eac084846d462d34037676f54d39ffccb387d1f185378c92442f817ad7121f07e52b1940c0598ab531eb9f0

Score
10/10
redline1discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

194.156.99.113:46237

Attributes
  • auth_value

    46329fc87924eb6eaf95dbb680b20dbd

Targets

    • Target

      1668-55-0x0000000000370000-0x0000000000390000-memory.dmp

    • Size

      128KB

    • MD5

      87615e1a3f408e63259116083fad6392

    • SHA1

      1a3688ef0f2cb1ef9c1963a93c2eadeba8f734d1

    • SHA256

      52066c6ca336690c58b365ec147e4e00bb22db315a3890cfd3626921821f1abe

    • SHA512

      771e0006f1fc72fe7e1e3c8bff2f4359cb83d6797eac084846d462d34037676f54d39ffccb387d1f185378c92442f817ad7121f07e52b1940c0598ab531eb9f0

    Score
    10/10
    redline1discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks