redline | 6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df

General

Target

6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe
Size

358KB
MD5

b03bee3a7187edf8b50a43c668177999
SHA1

749324bc9b91f839edf28f1b48d3116293796366
SHA256

6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df
SHA512

cca1f1654cd8c5c3fe0bdbd4530c886f2e32bf5d116b26888d2c40b33bcf2b9ac9502b08ac2c9ac5bc5faac3903a7e59c65e084ca70ec20329aba5367ca89a73
SSDEEP

6144:5Bq7LRUOZCq1s4DnoJpzz1c+fPL5zV8kLRRLJtQJZyNHA:5Bq7KOZC2s4Tkz1csz5zV8kT9tf

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/384-136-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-137-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-139-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-141-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-143-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-145-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-147-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-149-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-153-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-156-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-158-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-160-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-162-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-164-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-166-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-168-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-170-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-172-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-174-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-176-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-178-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-180-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-182-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-184-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-186-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-188-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-190-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-192-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-194-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-196-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-198-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-200-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline
behavioral1/memory/384-202-0x0000000004FA0000-0x0000000004FF2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 384 WerFault.exe 6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

pid	pid_target	process	target process
2180	384	WerFault.exe	6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

pid	process
384	6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe
384	6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

description pid process

Token: SeDebugPrivilege 384 6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

description	pid	process
Token: SeDebugPrivilege	384	6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe

C:\Users\Admin\AppData\Local\Temp\6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe
"C:\Users\Admin\AppData\Local\Temp\6da600582a01c78e46918c988a5c7b5bf6f8280ed0bacd26bb5d0446495bd1df.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1220
2⤵
- Program crash
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 384 -ip 384
1⤵
PID:3184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-134-0x00000000025A0000-0x0000000002602000-memory.dmp

Filesize
392KB

Download
memory/384-135-0x0000000005190000-0x0000000005734000-memory.dmp

Filesize
5.6MB

Download
memory/384-136-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-137-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-139-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-141-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-143-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-145-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-147-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-149-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-150-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-152-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-154-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-153-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-156-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-158-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-160-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-162-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-164-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-166-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-168-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-170-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-172-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-174-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-176-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-178-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-180-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-182-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-184-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-186-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-188-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-190-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-192-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-194-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-196-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-198-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-200-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-202-0x0000000004FA0000-0x0000000004FF2000-memory.dmp

Filesize
328KB

Download
memory/384-929-0x0000000005740000-0x0000000005D58000-memory.dmp

Filesize
6.1MB

Download
memory/384-930-0x0000000005090000-0x00000000050A2000-memory.dmp

Filesize
72KB

Download
memory/384-931-0x0000000005D60000-0x0000000005E6A000-memory.dmp

Filesize
1.0MB

Download
memory/384-932-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-933-0x00000000050B0000-0x00000000050EC000-memory.dmp

Filesize
240KB

Download
memory/384-934-0x00000000060B0000-0x0000000006116000-memory.dmp

Filesize
408KB

Download
memory/384-935-0x0000000006780000-0x0000000006812000-memory.dmp

Filesize
584KB

Download
memory/384-936-0x0000000006A70000-0x0000000006AE6000-memory.dmp

Filesize
472KB

Download
memory/384-937-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/384-938-0x0000000006BF0000-0x0000000006DB2000-memory.dmp

Filesize
1.8MB

Download
memory/384-939-0x0000000006DD0000-0x00000000072FC000-memory.dmp

Filesize
5.2MB

Download
memory/384-942-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-943-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/384-944-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing