redline | 80f2e0c027acf95ee54e49a422dfbb1b07edd1701e77ee5de0b6159884c5ade4

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

345KB
MD5

cee6cbc002ea4ce3a2e609e48c8c2337
SHA1

49287a0674f4a564b95e1c486ebb0d3b7890bd13
SHA256

80f2e0c027acf95ee54e49a422dfbb1b07edd1701e77ee5de0b6159884c5ade4
SHA512

96cacf06fc9b66f43515c2ff2656497b66b75c261f04a674a9a29be2beca30da218290b01388a29e23ef2de3af0222fd7c384b30417238740b2e40e927bfbb45
SSDEEP

6144:/N9P/WiL0i4W0Dses/6/Ap2+zu/sNwJFVA95EzhDgvccfeKolUpRz5drDp:/N9Wi4i4W0DsesB2UDADHcRJ

Score

10^/10

redline neruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

neruzki

193.106.191.22:47242

Attributes

auth_value
be14ae67c6dd227f622680a27ea42452

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

784 file.exe
784 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 784 file.exe

pid	process
784	file.exe
784	file.exe

description	pid	process
Token: SeDebugPrivilege	784	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-54-0x00000000002AB000-0x00000000002E2000-memory.dmp

Filesize
220KB

Download
memory/784-55-0x0000000001CE0000-0x0000000001D39000-memory.dmp

Filesize
356KB

Download
memory/784-56-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/784-57-0x0000000004850000-0x000000000489C000-memory.dmp

Filesize
304KB

Download
memory/784-58-0x00000000048A0000-0x00000000048E8000-memory.dmp

Filesize
288KB

Download
memory/784-59-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-60-0x00000000002AB000-0x00000000002E2000-memory.dmp

Filesize
220KB

Download
memory/784-61-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download