redline | 6d25990d4209c3d4f3bca3dce35c021a00ec8a0ef9b8992e37bc257b5b5e82d4

General

Target

460c445a6d025393d093727d11a01c9f.exe
Size

1.0MB
MD5

460c445a6d025393d093727d11a01c9f
SHA1

6977ad07a0301469190eb71b3317bdfd1b049153
SHA256

6d25990d4209c3d4f3bca3dce35c021a00ec8a0ef9b8992e37bc257b5b5e82d4
SHA512

99b8fafd7ca57fdab65776678814f2323cb9653ab83c8724be781b9f6711d57a9d3e94027cf0bd1983b85d122b3d2463bdbfe7fd5fd25b15c712f40225bd8bce
SSDEEP

24576:e1EAEPR9yVWEnilKLwFK+gYn8PCiyywqn3WsouPm:e1FMnyVW8gFHgGC/kqn3Wso/

Score

10^/10

redline r101 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

R101

C2

94.130.179.90:21188

Attributes

auth_value
e838b35467aa845d380b9da0f7ba933c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1648-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1648-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1648-65-0x0000000000422192-mapping.dmp	family_redline
behavioral1/memory/1648-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1648-67-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1648-69-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description pid process target process

PID 804 set thread context of 1648 804 460c445a6d025393d093727d11a01c9f.exe 460c445a6d025393d093727d11a01c9f.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

pid process

1648 460c445a6d025393d093727d11a01c9f.exe
1648 460c445a6d025393d093727d11a01c9f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description pid process

Token: SeDebugPrivilege 1648 460c445a6d025393d093727d11a01c9f.exe

description	pid	process	target process
PID 804 set thread context of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe

pid	process
1648	460c445a6d025393d093727d11a01c9f.exe
1648	460c445a6d025393d093727d11a01c9f.exe

description	pid	process
Token: SeDebugPrivilege	1648	460c445a6d025393d093727d11a01c9f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description	pid	process	target process
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 804 wrote to memory of 1648	804	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe

C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe
"C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804

C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-54-0x0000000001120000-0x0000000001230000-memory.dmp

Filesize
1.1MB

Download
memory/804-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/804-56-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/804-57-0x0000000005820000-0x00000000058B0000-memory.dmp

Filesize
576KB

Download
memory/804-58-0x0000000004EB0000-0x0000000004EF4000-memory.dmp

Filesize
272KB

Download
memory/1648-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-65-0x0000000000422192-mapping.dmp

Download
memory/1648-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1648-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing