redline | 71e08b3ec6500046ea41335216d7483f6cd41e1c5edafd7dabe6a440537bf567

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-11-2022 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

494KB
MD5

33a5964afe2458441af9ea334f2d28f3
SHA1

7e3ad6f6676ea16d3558be146c53d9547ac338e3
SHA256

71e08b3ec6500046ea41335216d7483f6cd41e1c5edafd7dabe6a440537bf567
SHA512

c12a9fd312c21b347d0f6d80d836867a599de85590867fc884996c8ce8d6ecbdfd3ebb2ab8f2a71267a066aefc4004b71583422cce9c6f417666518aa2a7c68d
SSDEEP

12288:QtBpcGsfTLulmYlxUnrRJnPFk4CdDI+6:epcGGylZEnrRPch6

Score

10^/10

redline neruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

neruzki

193.106.191.22:47242

Attributes

auth_value
be14ae67c6dd227f622680a27ea42452

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

536 file.exe
536 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 536 file.exe

pid	process
536	file.exe
536	file.exe

description	pid	process
Token: SeDebugPrivilege	536	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/536-56-0x0000000000220000-0x0000000000279000-memory.dmp

Filesize
356KB

Download
memory/536-55-0x0000000000A0E000-0x0000000000A44000-memory.dmp

Filesize
216KB

Download
memory/536-57-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/536-58-0x00000000024E0000-0x000000000252C000-memory.dmp

Filesize
304KB

Download
memory/536-59-0x0000000002530000-0x0000000002578000-memory.dmp

Filesize
288KB

Download
memory/536-60-0x0000000000A0E000-0x0000000000A44000-memory.dmp

Filesize
216KB

Download
memory/536-61-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download