redline | 371f3bb20387dd610cb119b4cc54dfd2ca3bcad5c97b1cc1c608f340a6486d16

General

Target

e6e43272252f7ee744283f11acd234f7.exe
Size

3.9MB
MD5

e6e43272252f7ee744283f11acd234f7
SHA1

bfa1f8be1c7153c4dc6eb0f2a8b4c7c0f2d7dd8b
SHA256

371f3bb20387dd610cb119b4cc54dfd2ca3bcad5c97b1cc1c608f340a6486d16
SHA512

c67af7163f323e7a7eff882e550674d3e6cae7cb98b4e0f94ae6bb8da037e085498148250b34c510c76756ae4bb5da4159d52f981764a1ee6128ddef414b69e3

Score

10^/10

redline ytstealer infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

C2

185.215.113.23:15912

Attributes

auth_value
2e05da16ff667c8d53d0673cd5b4e948

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/832-54-0x0000000000400000-0x0000000000AA3000-memory.dmp	family_redline
behavioral1/memory/87700-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/87700-65-0x000000000041B50E-mapping.dmp	family_redline
behavioral1/memory/87700-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/87700-66-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/87352-73-0x0000000001260000-0x0000000002072000-memory.dmp	family_ytstealer
behavioral1/memory/87352-74-0x0000000001260000-0x0000000002072000-memory.dmp	family_ytstealer

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

filename.exe

pid process

87352 filename.exe

pid	process
87352	filename.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\filename.exe	upx
\Users\Admin\AppData\Local\Temp\filename.exe	upx
C:\Users\Admin\AppData\Local\Temp\filename.exe	upx
behavioral1/memory/87352-73-0x0000000001260000-0x0000000002072000-memory.dmp	upx
behavioral1/memory/87352-74-0x0000000001260000-0x0000000002072000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

AppLaunch.exe

pid process

87700 AppLaunch.exe
87700 AppLaunch.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

e6e43272252f7ee744283f11acd234f7.exe

description pid process target process

PID 832 set thread context of 87700 832 e6e43272252f7ee744283f11acd234f7.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AppLaunch.exe

pid process

87700 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 87700 AppLaunch.exe

pid	process
87700	AppLaunch.exe
87700	AppLaunch.exe

description	pid	process	target process
PID 832 set thread context of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe

pid	process
87700	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	87700	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

e6e43272252f7ee744283f11acd234f7.exeAppLaunch.exe

description	pid	process	target process
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 832 wrote to memory of 87700	832	e6e43272252f7ee744283f11acd234f7.exe	AppLaunch.exe
PID 87700 wrote to memory of 87352	87700	AppLaunch.exe	filename.exe
PID 87700 wrote to memory of 87352	87700	AppLaunch.exe	filename.exe
PID 87700 wrote to memory of 87352	87700	AppLaunch.exe	filename.exe
PID 87700 wrote to memory of 87352	87700	AppLaunch.exe	filename.exe

C:\Users\Admin\AppData\Local\Temp\e6e43272252f7ee744283f11acd234f7.exe
"C:\Users\Admin\AppData\Local\Temp\e6e43272252f7ee744283f11acd234f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:87700

C:\Users\Admin\AppData\Local\Temp\filename.exe
"C:\Users\Admin\AppData\Local\Temp\filename.exe"
3⤵
- Executes dropped EXE
PID:87352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
4.0MB

MD5
6452e14763ae943f8e556f65c09473eb

SHA1
290981d61d73c696b475c8fefed323b569418bde

SHA256
bc35c66b1be35a701e70388789b6446093fa71716801c8828c3f363eee1a183e

SHA512
44ac3be1c66b734a908a88c79df310788dd5edd1e8bbaa577682459163fa347282a937d4d4d48710e1a1f08e89ca8d4674cbdbc51e015539dce4509645727796

Download Submit
memory/832-54-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/87352-74-0x0000000001260000-0x0000000002072000-memory.dmp

Filesize
14.1MB

Download
memory/87352-73-0x0000000001260000-0x0000000002072000-memory.dmp

Filesize
14.1MB

Download
memory/87352-71-0x0000000000000000-mapping.dmp

Download
memory/87700-65-0x000000000041B50E-mapping.dmp

Download
memory/87700-68-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/87700-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/87700-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/87700-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/87700-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads