redline | 0463d7c695a2f812992eacbd3e29843a0f4a49a0f664606cd9dc11bac67148e8

General

Target

4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe
Size

361KB
MD5

a413967d29faa8bfe4a16a4559cb31c0
SHA1

73e5da45efb8fd5d49bafce6dee1dd821cdb8988
SHA256

4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5
SHA512

74ac0edf2c551b28dde2f97978cb8904040365939e4e6eb45da0408d5b3d333705d103954a71c44221867a9919d899448013316852e5b795e8b6f28a6e25850e
SSDEEP

6144:FLPm5PKqhKsktou8kTRjK12KUl9fNGEXjzgU0onQCf4eZ:FLmtJGXTaqlFNfvgUJ5/Z

Score

10^/10

redline fud discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1948-136-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-137-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-139-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-141-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-143-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-145-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-147-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-149-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-151-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-153-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-155-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-157-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-159-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-161-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-165-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-171-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-181-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-183-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-179-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-185-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-189-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-191-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-193-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-187-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-177-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-195-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-175-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-173-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-197-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-169-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-201-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-199-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-167-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral2/memory/1948-1054-0x00000000024D0000-0x00000000024E0000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4456 1948 WerFault.exe 4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

pid	pid_target	process	target process
4456	1948	WerFault.exe	4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

pid	process
1948	4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe
1948	4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

description pid process

Token: SeDebugPrivilege 1948 4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

description	pid	process
Token: SeDebugPrivilege	1948	4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe

C:\Users\Admin\AppData\Local\Temp\4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe
"C:\Users\Admin\AppData\Local\Temp\4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 1572
2⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1948 -ip 1948
1⤵
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-134-0x0000000000630000-0x000000000067B000-memory.dmp

Filesize
300KB

Download
memory/1948-135-0x0000000004D10000-0x00000000052B4000-memory.dmp

Filesize
5.6MB

Download
memory/1948-136-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-137-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-139-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-141-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-143-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-145-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-147-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-149-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-151-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-153-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-155-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-157-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-159-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-162-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-161-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-165-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-171-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-181-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-183-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-179-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-185-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-189-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-191-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-193-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-187-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-177-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-195-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-175-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-173-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-197-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-169-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-201-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-199-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-167-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1948-164-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-1044-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/1948-1045-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/1948-1046-0x0000000005A00000-0x0000000005A12000-memory.dmp

Filesize
72KB

Download
memory/1948-1047-0x0000000005A20000-0x0000000005A5C000-memory.dmp

Filesize
240KB

Download
memory/1948-1048-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-1050-0x0000000005D10000-0x0000000005DA2000-memory.dmp

Filesize
584KB

Download
memory/1948-1051-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/1948-1052-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-1053-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-1054-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1948-1055-0x00000000064A0000-0x0000000006516000-memory.dmp

Filesize
472KB

Download
memory/1948-1056-0x0000000006530000-0x0000000006580000-memory.dmp

Filesize
320KB

Download
memory/1948-1057-0x00000000067E0000-0x00000000069A2000-memory.dmp

Filesize
1.8MB

Download
memory/1948-1058-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Filesize
5.2MB

Download
memory/1948-1059-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing