redline | 6d25990d4209c3d4f3bca3dce35c021a00ec8a0ef9b8992e37bc257b5b5e82d4

General

Target

460c445a6d025393d093727d11a01c9f.exe
Size

1.0MB
MD5

460c445a6d025393d093727d11a01c9f
SHA1

6977ad07a0301469190eb71b3317bdfd1b049153
SHA256

6d25990d4209c3d4f3bca3dce35c021a00ec8a0ef9b8992e37bc257b5b5e82d4
SHA512

99b8fafd7ca57fdab65776678814f2323cb9653ab83c8724be781b9f6711d57a9d3e94027cf0bd1983b85d122b3d2463bdbfe7fd5fd25b15c712f40225bd8bce
SSDEEP

24576:e1EAEPR9yVWEnilKLwFK+gYn8PCiyywqn3WsouPm:e1FMnyVW8gFHgGC/kqn3Wso/

Score

10^/10

redline r101 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

R101

C2

94.130.179.90:21188

Attributes

auth_value
e838b35467aa845d380b9da0f7ba933c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/32-138-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description pid process target process

PID 4880 set thread context of 32 4880 460c445a6d025393d093727d11a01c9f.exe 460c445a6d025393d093727d11a01c9f.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

pid process

32 460c445a6d025393d093727d11a01c9f.exe
32 460c445a6d025393d093727d11a01c9f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description pid process

Token: SeDebugPrivilege 32 460c445a6d025393d093727d11a01c9f.exe

description	pid	process	target process
PID 4880 set thread context of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe

pid	process
32	460c445a6d025393d093727d11a01c9f.exe
32	460c445a6d025393d093727d11a01c9f.exe

description	pid	process
Token: SeDebugPrivilege	32	460c445a6d025393d093727d11a01c9f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

460c445a6d025393d093727d11a01c9f.exe

description	pid	process	target process
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe
PID 4880 wrote to memory of 32	4880	460c445a6d025393d093727d11a01c9f.exe	460c445a6d025393d093727d11a01c9f.exe

C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe
"C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\460c445a6d025393d093727d11a01c9f.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\460c445a6d025393d093727d11a01c9f.exe.log
Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
memory/32-144-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/32-143-0x00000000054C0000-0x00000000054FC000-memory.dmp

Filesize
240KB

Download
memory/32-148-0x0000000007490000-0x00000000079BC000-memory.dmp

Filesize
5.2MB

Download
memory/32-147-0x0000000006750000-0x0000000006912000-memory.dmp

Filesize
1.8MB

Download
memory/32-141-0x0000000005510000-0x000000000561A000-memory.dmp

Filesize
1.0MB

Download
memory/32-138-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/32-146-0x0000000006530000-0x0000000006580000-memory.dmp

Filesize
320KB

Download
memory/32-145-0x0000000006480000-0x00000000064F6000-memory.dmp

Filesize
472KB

Download
memory/32-137-0x0000000000000000-mapping.dmp

Download
memory/32-142-0x0000000005440000-0x0000000005452000-memory.dmp

Filesize
72KB

Download
memory/32-140-0x00000000059A0000-0x0000000005FB8000-memory.dmp

Filesize
6.1MB

Download
memory/4880-132-0x0000000000E70000-0x0000000000F80000-memory.dmp

Filesize
1.1MB

Download
memory/4880-133-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/4880-134-0x0000000005920000-0x00000000059B2000-memory.dmp

Filesize
584KB

Download
memory/4880-136-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/4880-135-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing