redline | 861d2eb8308e360176d2d83d65f519f083f9de040d903060d711847a770c711e

General

Target

aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe
Size

5.6MB
MD5

b3b0630feab568055f33b84593b6a0b3
SHA1

e9cb1f95f51fcf31ecbc132f822897cb8dab839f
SHA256

aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4
SHA512

752e20041e43364a68a5fc21e55307835a8b479b49ade1d8cf60a90ed62fe611753abaeda35735a61c2ec80c6982e3b97f067ea22c55ce1afbb7fc6741a37bd6
SSDEEP

49152:QOItTQxFtNaMDZ936iEIf1bisoBgpN5F:QOItTih

Score

10^/10

redline 3108_ruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

3108_RUZKI

C2

213.219.247.199:9452

Attributes

auth_value
f71fed1cd094e4e1eb7ad1c53e542bca

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1388-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1388-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1388-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1388-63-0x000000000041ADD2-mapping.dmp	family_redline
behavioral1/memory/1388-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1388-67-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe

description	pid	process	target process
PID 1416 set thread context of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1388 RegAsm.exe

pid	process
1388	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe
Token: SeDebugPrivilege	1388	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe

description	pid	process	target process
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe
PID 1416 wrote to memory of 1388	1416	aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe
"C:\Users\Admin\AppData\Local\Temp\aba67ec9bd4de3a05d77d0049c165058d642c40bb27f67f87748ee712f8f38b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-63-0x000000000041ADD2-mapping.dmp

Download
memory/1388-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1388-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-54-0x0000000000F30000-0x00000000014D2000-memory.dmp

Filesize
5.6MB

Download
memory/1416-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000000D20000-0x0000000000D86000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads