redline | 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/03/2023, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

175KB
MD5

20b01b94fec9143a2adf624945aa41c3
SHA1

3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256

97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
SHA512

52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68
SSDEEP

3072:4xqZWVba1Qhu/q55e55FQhMvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+c3:mqZ9q52Qh

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

66.42.108.195:40499

Attributes

auth_value
f93019ca42e7f9440be3a7ee1ebc636d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1308	tmp.exe
1308	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000000FA0000-0x0000000000FD2000-memory.dmp

Filesize
200KB

Download
memory/1308-55-0x00000000047B0000-0x00000000047F0000-memory.dmp

Filesize
256KB

Download
memory/1308-56-0x00000000047B0000-0x00000000047F0000-memory.dmp

Filesize
256KB

Download