redline | 78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466

General

Target

78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe
Size

360KB
MD5

229f45ca9b43dc158b48ef4fe7c5b22a
SHA1

1b54f317c29b894ecc74ad6a5c93a81fa4cbd298
SHA256

78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466
SHA512

e626f1532a08e038ade371b710ab98f5e528b668c8641a6d1836c7cfadfb0cff8ad6ae83f0367e76768d98ec00fe432ccb81d35f2da37bd5661e3f9c4cb65520
SSDEEP

6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Score

10^/10

redline 0002 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes

auth_value
866ce0ed8cfe2be77fb43a4912677698

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/544-132-0x0000000000680000-0x00000000006E0000-memory.dmp	family_redline
behavioral1/files/0x0003000000022e06-145.dat	family_redline
behavioral1/files/0x0003000000022e06-146.dat	family_redline

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3136	build.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe
544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe
3136	build.exe
3136	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe
Token: SeDebugPrivilege	3136	build.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 3136	544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe	95
PID 544 wrote to memory of 3136	544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe	95
PID 544 wrote to memory of 3136	544	78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe	95

C:\Users\Admin\AppData\Local\Temp\78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe
"C:\Users\Admin\AppData\Local\Temp\78bdd263dbfe89208f70d4827f1b319b6b4c65d34ffe62b75fc018eb41e1f466.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
360KB

MD5
5c41fd46912f2470a13394b70163b85e

SHA1
b4b4ed28552c5ba8a49b4107a5315915b23d61e5

SHA256
5c5932d626ed2fbabef5f1da4538c21f6d8667302e48a9bcc3240acfa69853b2

SHA512
827448ce8440aeb10edf19b45ccb4e8ae47a3eddccfc35fb5041adf23986c9d887b753025c47e0b111c4679fd55f4ced6f0a3e5973a4bd6cad846b58e348cc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
360KB

MD5
5c41fd46912f2470a13394b70163b85e

SHA1
b4b4ed28552c5ba8a49b4107a5315915b23d61e5

SHA256
5c5932d626ed2fbabef5f1da4538c21f6d8667302e48a9bcc3240acfa69853b2

SHA512
827448ce8440aeb10edf19b45ccb4e8ae47a3eddccfc35fb5041adf23986c9d887b753025c47e0b111c4679fd55f4ced6f0a3e5973a4bd6cad846b58e348cc63

Download Submit
memory/544-138-0x00000000060D0000-0x0000000006162000-memory.dmp

Filesize
584KB

Download
memory/544-135-0x0000000002C60000-0x0000000002C72000-memory.dmp

Filesize
72KB

Download
memory/544-136-0x0000000005230000-0x000000000526C000-memory.dmp

Filesize
240KB

Download
memory/544-137-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/544-132-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/544-139-0x00000000068D0000-0x0000000006E74000-memory.dmp

Filesize
5.6MB

Download
memory/544-140-0x00000000064F0000-0x00000000066B2000-memory.dmp

Filesize
1.8MB

Download
memory/544-141-0x0000000008AA0000-0x0000000008FCC000-memory.dmp

Filesize
5.2MB

Download
memory/544-142-0x0000000006460000-0x00000000064D6000-memory.dmp

Filesize
472KB

Download
memory/544-143-0x00000000066C0000-0x0000000006710000-memory.dmp

Filesize
320KB

Download
memory/544-134-0x0000000005300000-0x000000000540A000-memory.dmp

Filesize
1.0MB

Download
memory/544-133-0x0000000005810000-0x0000000005E28000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing