redline | 0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca

General

Target

0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe
Size

493KB
MD5

4d2c027c117135aaaad054ef061969ed
SHA1

be9026570296cb0d1e86197713123626a3a54e8a
SHA256

0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca
SHA512

125306497c92ca42afa74937b7e3e725ad3cfe1583ca53670ec074f2fc2c379f3426e1a9c64a805bc75a02c5540a67daa303bc10776d50883b4031df84d5674d
SSDEEP

6144:bFxnOH0h0CYbPy11TLD5MhDsqhAhBafkcomjVG:hNOH0hNYQ/YD8mksw

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1504-139-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-140-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-142-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-144-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-148-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-146-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-150-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-152-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-154-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-156-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-158-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-160-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-162-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-164-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-166-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-168-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-170-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-172-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-174-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-176-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-178-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-180-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-182-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-184-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-186-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-188-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-190-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-192-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-194-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-196-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-198-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-200-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline
behavioral1/memory/1504-202-0x00000000027E0000-0x0000000002832000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4652 1504 WerFault.exe 0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

pid	pid_target	process	target process
4652	1504	WerFault.exe	0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

pid	process
1504	0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe
1504	0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

description pid process

Token: SeDebugPrivilege 1504 0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

description	pid	process
Token: SeDebugPrivilege	1504	0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe

C:\Users\Admin\AppData\Local\Temp\0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe
"C:\Users\Admin\AppData\Local\Temp\0768bc20b738db987fa07ce2484f1e4d2b3cdac4776758fed59207dfb7117cca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1228
2⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1504 -ip 1504
1⤵
PID:3532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-134-0x0000000002270000-0x00000000022D2000-memory.dmp

Filesize
392KB

Download
memory/1504-136-0x0000000004D00000-0x00000000052A4000-memory.dmp

Filesize
5.6MB

Download
memory/1504-137-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-135-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-138-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-139-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-140-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-142-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-144-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-148-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-146-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-150-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-152-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-154-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-156-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-158-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-160-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-162-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-164-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-166-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-168-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-170-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-172-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-174-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-176-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-178-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-180-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-182-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-184-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-186-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-188-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-190-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-192-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-194-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-196-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-198-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-200-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-202-0x00000000027E0000-0x0000000002832000-memory.dmp

Filesize
328KB

Download
memory/1504-929-0x00000000052B0000-0x00000000058C8000-memory.dmp

Filesize
6.1MB

Download
memory/1504-930-0x0000000005920000-0x0000000005932000-memory.dmp

Filesize
72KB

Download
memory/1504-931-0x0000000005940000-0x0000000005A4A000-memory.dmp

Filesize
1.0MB

Download
memory/1504-932-0x0000000005A50000-0x0000000005A8C000-memory.dmp

Filesize
240KB

Download
memory/1504-933-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-934-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Filesize
408KB

Download
memory/1504-935-0x0000000006430000-0x00000000064C2000-memory.dmp

Filesize
584KB

Download
memory/1504-936-0x00000000064E0000-0x0000000006556000-memory.dmp

Filesize
472KB

Download
memory/1504-937-0x00000000065C0000-0x0000000006782000-memory.dmp

Filesize
1.8MB

Download
memory/1504-938-0x00000000067A0000-0x0000000006CCC000-memory.dmp

Filesize
5.2MB

Download
memory/1504-939-0x0000000006DF0000-0x0000000006E0E000-memory.dmp

Filesize
120KB

Download
memory/1504-941-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-942-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1504-943-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing