redline | a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445

General

Target

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
Size

2.8MB
MD5

31a9a8c6d1d79fc6afdd9a5c991188f1
SHA1

d294e06685c76d32338585564ebe9c4ff49dd067
SHA256

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445
SHA512

48e8d0a33ba514106fa95f1e8e2fdfb74083de0c2434b3d3bbb716cc8a78a66ee657044dd36b70291ce369ba75624f977560c32a5a96cefe7ee54a92f5e5500a
SSDEEP

49152:crvnXYyaoU7Efzua3KIVouFK+hByJPD6hXlunD3tzQ:crvnnUIfzD37FlW1QVm9E

Score

10^/10

redline 0512 infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

0512

C2

81.161.229.143:26910

Attributes

auth_value
c020923553bd23ba826df75b6d76d4de

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1276-66-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/1276-67-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/1276-68-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/1276-69-0x000000000045B05E-mapping.dmp	family_redline
behavioral1/memory/1276-71-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/1276-73-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

5150725674.exe

pid process

1744 5150725674.exe
Loads dropped DLL 1 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe

pid process

268 a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1744	5150725674.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe

description	pid	process	target process
PID 268 set thread context of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exeInstallUtil.exe

pid	process
268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
1276	InstallUtil.exe
1276	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
Token: SeDebugPrivilege	1276	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe

description	pid	process	target process
PID 268 wrote to memory of 1744	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 268 wrote to memory of 1744	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 268 wrote to memory of 1744	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 268 wrote to memory of 1744	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	5150725674.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe
PID 268 wrote to memory of 1276	268	a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe
"C:\Users\Admin\AppData\Local\Temp\a80c89e6bc5d2aa9ff033799651cbb9bd11cf3b75eaf49552bd59cc88fcb5445.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe"
2⤵
- Executes dropped EXE
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe
Filesize
2.5MB

MD5
94b7f381f92902712b845c2113b14d93

SHA1
9af6129d6e1200aece810cb369e0295f5bcffec0

SHA256
262d5cb04240f682b0dd872be29f7c7e2a9913934f08e341695524a38d56fc37

SHA512
da98600b847fb9769131b999f7c87d75e71f4b48334145877e9f61c973c5d3a11d83bfc1b3bb76df8da60ac12cb03a7c76ffb3a0bae55e4425884df25077b2ee

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\5150725674.exe
Filesize
2.5MB

MD5
94b7f381f92902712b845c2113b14d93

SHA1
9af6129d6e1200aece810cb369e0295f5bcffec0

SHA256
262d5cb04240f682b0dd872be29f7c7e2a9913934f08e341695524a38d56fc37

SHA512
da98600b847fb9769131b999f7c87d75e71f4b48334145877e9f61c973c5d3a11d83bfc1b3bb76df8da60ac12cb03a7c76ffb3a0bae55e4425884df25077b2ee

Download Submit
memory/268-62-0x0000000000C60000-0x0000000000C66000-memory.dmp

Filesize
24KB

Download
memory/268-54-0x0000000000110000-0x00000000003E4000-memory.dmp

Filesize
2.8MB

Download
memory/268-56-0x0000000000770000-0x00000000007A0000-memory.dmp

Filesize
192KB

Download
memory/268-57-0x00000000006D0000-0x00000000006E8000-memory.dmp

Filesize
96KB

Download
memory/268-55-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/268-61-0x0000000004340000-0x000000000435A000-memory.dmp

Filesize
104KB

Download
memory/1276-63-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-64-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-66-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-67-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-68-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-69-0x000000000045B05E-mapping.dmp

Download
memory/1276-71-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-73-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1276-74-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/1744-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads