redline | 5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a

General

Target

5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe
Size

348KB
MD5

26f28261c1b0b0b5ca712bf8ab65c243
SHA1

2efd6296000c4503df671aabf30eae52418c867b
SHA256

5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a
SHA512

adc4a90ba1223773fbc57b7486e053e7d71e3887734e753a9add5087967a3d73004a3c5cbbea17b9a87b7bd70bc1205f98ff9e22fdf433e6355bdd106573fa53
SSDEEP

6144:EMKUPLtLXU6CgKL1IvSu6DiapQg/CyJkmeInqy9/iz8ythZOFCaI:VJPLt7U6ChL12i4PBnlAA3

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/404-123-0x0000000002730000-0x000000000278A000-memory.dmp	family_redline
behavioral1/memory/404-125-0x0000000005250000-0x00000000052A8000-memory.dmp	family_redline
behavioral1/memory/404-127-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-126-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-129-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-131-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-133-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-135-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-137-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-141-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-143-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-139-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-145-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-147-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-149-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-153-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-151-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-157-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-165-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-170-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-180-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-182-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-178-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-176-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-174-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-190-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-192-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-188-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-186-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-184-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-167-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-163-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-161-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-159-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline
behavioral1/memory/404-155-0x0000000005250000-0x00000000052A2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe

pid	process
404	5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe
404	5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe

description pid process

Token: SeDebugPrivilege 404 5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe

description	pid	process
Token: SeDebugPrivilege	404	5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe

C:\Users\Admin\AppData\Local\Temp\5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe
"C:\Users\Admin\AppData\Local\Temp\5883f06723eaa7f8e591a20d792e4cedcca20fe33e6abc6d00f7b93c503d2d3a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-122-0x0000000000890000-0x00000000008F2000-memory.dmp

Filesize
392KB

Download
memory/404-123-0x0000000002730000-0x000000000278A000-memory.dmp

Filesize
360KB

Download
memory/404-124-0x0000000004D10000-0x000000000520E000-memory.dmp

Filesize
5.0MB

Download
memory/404-125-0x0000000005250000-0x00000000052A8000-memory.dmp

Filesize
352KB

Download
memory/404-127-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-126-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-129-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-131-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-133-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-135-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-137-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-141-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-143-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-139-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-145-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-147-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-149-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-153-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-151-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-157-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-165-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-169-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/404-170-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-171-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/404-173-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/404-180-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-182-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-178-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-176-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-174-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-190-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-192-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-188-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-186-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-184-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-167-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-163-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-161-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-159-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-155-0x0000000005250000-0x00000000052A2000-memory.dmp

Filesize
328KB

Download
memory/404-919-0x00000000052B0000-0x00000000058B6000-memory.dmp

Filesize
6.0MB

Download
memory/404-920-0x0000000005900000-0x0000000005912000-memory.dmp

Filesize
72KB

Download
memory/404-921-0x0000000005920000-0x0000000005A2A000-memory.dmp

Filesize
1.0MB

Download
memory/404-922-0x0000000005A30000-0x0000000005A6E000-memory.dmp

Filesize
248KB

Download
memory/404-923-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/404-924-0x0000000005AC0000-0x0000000005B0B000-memory.dmp

Filesize
300KB

Download
memory/404-925-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/404-926-0x0000000006400000-0x0000000006492000-memory.dmp

Filesize
584KB

Download
memory/404-927-0x00000000064A0000-0x0000000006516000-memory.dmp

Filesize
472KB

Download
memory/404-928-0x0000000006550000-0x000000000656E000-memory.dmp

Filesize
120KB

Download
memory/404-929-0x0000000006870000-0x0000000006A32000-memory.dmp

Filesize
1.8MB

Download
memory/404-930-0x0000000006A40000-0x0000000006F6C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing