redline | e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25

General

Target

e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe
Size

348KB
MD5

a1b3a5aeb0be8e313d30ff2e38080dc7
SHA1

1bd1bcfb15f5bcb86b3f66849c76b4ee9d1c97e1
SHA256

e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25
SHA512

3fd5f8933777284b80aa2da2a2f235e4d9c8f6c9486786a03c0893c51f7b69955ffa4b92500c9cea7c5afeae369cc3d5c5a31eb33546ee7cbcad0972306866a7
SSDEEP

6144:Cz/ckLULhOU6O0zDQztB/9AhaNYHlTa3gntzAJzp3UK5itSvvoKueJtyU:LkLUdOU6O0+/wYpoeLct28

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3268-139-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-140-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-142-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-144-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-146-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-148-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-150-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-152-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-154-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-156-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-160-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-162-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-158-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-164-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-166-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-168-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-170-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-172-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-174-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-176-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-184-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-188-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-186-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-190-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-182-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-180-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-178-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-196-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-194-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-198-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-200-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-202-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline
behavioral1/memory/3268-192-0x00000000028D0000-0x0000000002922000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1856 3268 WerFault.exe e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

pid	pid_target	process	target process
1856	3268	WerFault.exe	e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

pid	process
3268	e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe
3268	e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

description pid process

Token: SeDebugPrivilege 3268 e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

description	pid	process
Token: SeDebugPrivilege	3268	e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe

C:\Users\Admin\AppData\Local\Temp\e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe
"C:\Users\Admin\AppData\Local\Temp\e8231df639c9ac9285b8083d37f0b56ea5167eec805567cd635ba2ea253ada25.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 1752
2⤵
- Program crash
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3268 -ip 3268
1⤵
PID:3180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-134-0x00000000008B0000-0x0000000000912000-memory.dmp

Filesize
392KB

Download
memory/3268-135-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-136-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-137-0x0000000004FB0000-0x0000000005554000-memory.dmp

Filesize
5.6MB

Download
memory/3268-138-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-139-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-140-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-142-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-144-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-146-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-148-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-150-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-152-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-154-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-156-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-160-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-162-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-158-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-164-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-166-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-168-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-170-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-172-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-174-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-176-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-184-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-188-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-186-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-190-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-182-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-180-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-178-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-196-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-194-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-198-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-200-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-202-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-192-0x00000000028D0000-0x0000000002922000-memory.dmp

Filesize
328KB

Download
memory/3268-930-0x0000000005560000-0x0000000005B78000-memory.dmp

Filesize
6.1MB

Download
memory/3268-931-0x0000000002A10000-0x0000000002A22000-memory.dmp

Filesize
72KB

Download
memory/3268-932-0x0000000005B80000-0x0000000005C8A000-memory.dmp

Filesize
1.0MB

Download
memory/3268-933-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-934-0x0000000005C90000-0x0000000005CCC000-memory.dmp

Filesize
240KB

Download
memory/3268-935-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Filesize
408KB

Download
memory/3268-936-0x0000000006650000-0x00000000066E2000-memory.dmp

Filesize
584KB

Download
memory/3268-937-0x0000000006700000-0x0000000006776000-memory.dmp

Filesize
472KB

Download
memory/3268-938-0x00000000067C0000-0x00000000067DE000-memory.dmp

Filesize
120KB

Download
memory/3268-939-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-940-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-941-0x0000000006980000-0x0000000006B42000-memory.dmp

Filesize
1.8MB

Download
memory/3268-942-0x0000000006B60000-0x000000000708C000-memory.dmp

Filesize
5.2MB

Download
memory/3268-943-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/3268-946-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing