redline | def0a557e76910ab9d94e8e7e6915e552278258f1553cf98dbd75eca1370c32b

General

Target

92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe
Size

385KB
MD5

55b1fd7484074158f9e9e8f657ec5a94
SHA1

6988125039cbf77b4ff06fa75fa56975004d3333
SHA256

92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22
SHA512

a7b292cc74578308b4c3d129809119a96c6522185e05ddaefb294ae6636894a145383140d23b1d3217f300ee63646d6f185fdb02dcbd9ab0ee5d840aa49b4de9
SSDEEP

12288:3fW6EQ0byZvdEnOuX9opfM99K0S+pOxOTEh25D:3fCbyZvdEnFX9op2KQKdhA

Score

10^/10

redline top1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

top1

C2

chardhesha.xyz:81

jalocliche.xyz:81

Attributes

auth_value
fa2afa98a6579319e36e31ee0552bd57

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Windows\Temp\top1.exe	family_redline
C:\Windows\Temp\top1.exe	family_redline
behavioral2/memory/1948-136-0x0000000000DB0000-0x0000000000DD8000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

top1.exe

pid process

1948 top1.exe

pid	process
1948	top1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

top1.exe

pid process

1948 top1.exe

pid	process
1948	top1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exetop1.exe

description	pid	process
Token: SeDebugPrivilege	4304	92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe
Token: SeDebugPrivilege	1948	top1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe

description	pid	process	target process
PID 4304 wrote to memory of 1948	4304	92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe	top1.exe
PID 4304 wrote to memory of 1948	4304	92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe	top1.exe
PID 4304 wrote to memory of 1948	4304	92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe	top1.exe

C:\Users\Admin\AppData\Local\Temp\92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe
"C:\Users\Admin\AppData\Local\Temp\92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\Temp\top1.exe
"C:\Windows\Temp\top1.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\top1.exe
Filesize
137KB

MD5
a135b9085fa8ef921eec14057b03125f

SHA1
4bf5ad5601da96ad4304f3d02b169868c972415d

SHA256
24aebc01eb25512c266cc73a1bf90a40b92e5924ddb94ba6db3be9aa89539ea3

SHA512
c7d4f74bedb81125a5ba42dad7be1dfa8220f1f5da96d61cc3e6b87fa9dd18217b9c6683ab6f16e0197084eead7db50df401d06a7ef4434038512d7d391effab

Download Submit
C:\Windows\Temp\top1.exe
Filesize
137KB

MD5
a135b9085fa8ef921eec14057b03125f

SHA1
4bf5ad5601da96ad4304f3d02b169868c972415d

SHA256
24aebc01eb25512c266cc73a1bf90a40b92e5924ddb94ba6db3be9aa89539ea3

SHA512
c7d4f74bedb81125a5ba42dad7be1dfa8220f1f5da96d61cc3e6b87fa9dd18217b9c6683ab6f16e0197084eead7db50df401d06a7ef4434038512d7d391effab

Download Submit
memory/1948-138-0x0000000005830000-0x000000000593A000-memory.dmp

Filesize
1.0MB

Download
memory/1948-133-0x0000000000000000-mapping.dmp

Download
memory/1948-136-0x0000000000DB0000-0x0000000000DD8000-memory.dmp

Filesize
160KB

Download
memory/1948-137-0x0000000005CB0000-0x00000000062C8000-memory.dmp

Filesize
6.1MB

Download
memory/1948-139-0x0000000005780000-0x0000000005792000-memory.dmp

Filesize
72KB

Download
memory/1948-140-0x00000000057A0000-0x00000000057DC000-memory.dmp

Filesize
240KB

Download
memory/1948-141-0x00000000074B0000-0x0000000007A54000-memory.dmp

Filesize
5.6MB

Download
memory/1948-142-0x0000000006FE0000-0x0000000007072000-memory.dmp

Filesize
584KB

Download
memory/1948-143-0x0000000007080000-0x00000000070E6000-memory.dmp

Filesize
408KB

Download
memory/1948-144-0x0000000007C30000-0x0000000007DF2000-memory.dmp

Filesize
1.8MB

Download
memory/1948-145-0x0000000008330000-0x000000000885C000-memory.dmp

Filesize
5.2MB

Download
memory/4304-132-0x0000000000FB0000-0x0000000001016000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads