redline | 3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60

Analysis

max time kernel
54s
max time network
57s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe
Size

137KB
MD5

0a793a6b9941c49675a47a2bc91cb420
SHA1

ff051cc2d9cf081e863f5bb8c3d2449c28f12c7f
SHA256

3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60
SHA512

fd695f62ef32f79f3b4e5c57c68056b004355d5a16e6558bfb310f8ded03c837fe5f505f5a4f433a740fa0b980a71962571c3dd4ed86d95146a22f126850dc36
SSDEEP

3072:zYO/ZMTFXn+IILj04nfwE64jTpWFByRPOhmSSU6s:zYMZMBXnbI8CfwwpvpOhI

Score

10^/10

redline lege discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Lege

31.41.244.14:4694

Attributes

auth_value
096090aaf3ba0872338140cec5689868

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/540-54-0x0000000000D30000-0x0000000000D58000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe

pid	process
540	3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe
540	3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe

description pid process

Token: SeDebugPrivilege 540 3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe

description	pid	process
Token: SeDebugPrivilege	540	3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe

C:\Users\Admin\AppData\Local\Temp\3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe
"C:\Users\Admin\AppData\Local\Temp\3bb977fda504647a2f21a19b67c3edf91ea1eb35166258164eb89b8ae1603c60.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-54-0x0000000000D30000-0x0000000000D58000-memory.dmp

Filesize
160KB

Download
memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download