redline | 6ace84c8a5b97075e435df18a59c7dcaa90091c8b3140deedf5139329d1890df

General

Target

e25ce9c2b5d24744369835f590f91d1a.exe
Size

3.9MB
MD5

e25ce9c2b5d24744369835f590f91d1a
SHA1

73b7c7c2cd35864ed4fe3969f8f8dc4242900ac1
SHA256

6ace84c8a5b97075e435df18a59c7dcaa90091c8b3140deedf5139329d1890df
SHA512

7c949da1f0cbdd49198f8ccb07b67a4222f1f3c9c9451bd7e871bb7561f5cd77a6f45006a3324a511cde7c216622c1811244ae03795e2106536e613325adee73

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

185.215.113.23:15912

Attributes

auth_value
2e05da16ff667c8d53d0673cd5b4e948

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1976-54-0x0000000000400000-0x0000000000AAD000-memory.dmp	family_redline
behavioral1/memory/66664-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/66664-66-0x000000000041B50E-mapping.dmp	family_redline
behavioral1/memory/66664-68-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/66664-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/67000-74-0x0000000001080000-0x0000000001E92000-memory.dmp	family_ytstealer
behavioral1/memory/67000-75-0x0000000001080000-0x0000000001E92000-memory.dmp	family_ytstealer

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
67000	filename.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000012326-70.dat	upx
behavioral1/files/0x0009000000012326-71.dat	upx
behavioral1/files/0x0009000000012326-73.dat	upx
behavioral1/memory/67000-74-0x0000000001080000-0x0000000001E92000-memory.dmp	upx
behavioral1/memory/67000-75-0x0000000001080000-0x0000000001E92000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
66664	AppLaunch.exe
66664	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
66664	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	66664	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 1976 wrote to memory of 66664	1976	e25ce9c2b5d24744369835f590f91d1a.exe	28
PID 66664 wrote to memory of 67000	66664	AppLaunch.exe	30
PID 66664 wrote to memory of 67000	66664	AppLaunch.exe	30
PID 66664 wrote to memory of 67000	66664	AppLaunch.exe	30
PID 66664 wrote to memory of 67000	66664	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\e25ce9c2b5d24744369835f590f91d1a.exe
"C:\Users\Admin\AppData\Local\Temp\e25ce9c2b5d24744369835f590f91d1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:66664
- - C:\Users\Admin\AppData\Local\Temp\filename.exe
    "C:\Users\Admin\AppData\Local\Temp\filename.exe"
    3⤵
    - Executes dropped EXE
    PID:67000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
memory/1976-54-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/66664-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/66664-69-0x0000000076A21000-0x0000000076A23000-memory.dmp

Filesize
8KB

Download
memory/66664-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/66664-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/66664-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/67000-74-0x0000000001080000-0x0000000001E92000-memory.dmp

Filesize
14.1MB

Download
memory/67000-75-0x0000000001080000-0x0000000001E92000-memory.dmp

Filesize
14.1MB

Download

Analysis

Sharing