redline | 9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395

General

Target

9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe
Size

467KB
MD5

be1af041b6208491ac3e908f3388c775
SHA1

70f00e3435971af66b66de9753b39443779b3ac7
SHA256

9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395
SHA512

5ff7a8737ad852d861f4d28cdf1d08ede2a1732c70cafb1e4316eb77f43c53d950ff3a9aab724f19a6f2a4ed290413033f62e82079f75b22884b55471e3396fb
SSDEEP

3072:l22GlhgH/sWjuaSl47XMAiPFW6+3FAqev2qVNEzFvpa8NbQigb8vknTidoWNwziD:2Ux08l36qY2qzEBJeiBvXVGiFvC2q

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1688-122-0x0000000002720000-0x000000000277A000-memory.dmp	family_redline
behavioral1/memory/1688-124-0x0000000004BE0000-0x0000000004C38000-memory.dmp	family_redline
behavioral1/memory/1688-127-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-128-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-130-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-132-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-134-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-138-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-136-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-140-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-142-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-144-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-148-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-156-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-158-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-162-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-160-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-154-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-166-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-168-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-164-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-152-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-150-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-146-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-170-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-178-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-186-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-190-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-188-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-184-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-182-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-180-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-176-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-174-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline
behavioral1/memory/1688-172-0x0000000004BE0000-0x0000000004C32000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe

pid	process
1688	9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe
1688	9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe

description pid process

Token: SeDebugPrivilege 1688 9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe

description	pid	process
Token: SeDebugPrivilege	1688	9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe

C:\Users\Admin\AppData\Local\Temp\9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe
"C:\Users\Admin\AppData\Local\Temp\9565591ec72c0ce38c83852516d526585b934e0346afff5a85e1a7aaeb50f395.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-122-0x0000000002720000-0x000000000277A000-memory.dmp

Filesize
360KB

Download
memory/1688-123-0x0000000004D50000-0x000000000524E000-memory.dmp

Filesize
5.0MB

Download
memory/1688-124-0x0000000004BE0000-0x0000000004C38000-memory.dmp

Filesize
352KB

Download
memory/1688-125-0x0000000000630000-0x0000000000692000-memory.dmp

Filesize
392KB

Download
memory/1688-126-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/1688-127-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-128-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-130-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-132-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-134-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-138-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-136-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-140-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-142-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-144-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-148-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-156-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-158-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-162-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-160-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-154-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-166-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-168-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-164-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-152-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-150-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-146-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-170-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-178-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-186-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-190-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-188-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-184-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-182-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-180-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-176-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-174-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-172-0x0000000004BE0000-0x0000000004C32000-memory.dmp

Filesize
328KB

Download
memory/1688-917-0x0000000005250000-0x0000000005856000-memory.dmp

Filesize
6.0MB

Download
memory/1688-918-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/1688-919-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/1688-920-0x0000000005970000-0x00000000059AE000-memory.dmp

Filesize
248KB

Download
memory/1688-921-0x00000000059E0000-0x0000000005A2B000-memory.dmp

Filesize
300KB

Download
memory/1688-922-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/1688-923-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Filesize
408KB

Download
memory/1688-924-0x0000000006320000-0x00000000063B2000-memory.dmp

Filesize
584KB

Download
memory/1688-925-0x00000000063D0000-0x0000000006446000-memory.dmp

Filesize
472KB

Download
memory/1688-926-0x0000000006520000-0x00000000066E2000-memory.dmp

Filesize
1.8MB

Download
memory/1688-927-0x00000000066F0000-0x0000000006C1C000-memory.dmp

Filesize
5.2MB

Download
memory/1688-928-0x0000000006CC0000-0x0000000006CDE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing