redline | 2649d65bd971a74b63f9cc854134599ce6f3829f4f6fc56c105ca7eceea7cf66

General

Target

file.exe
Size

355KB
MD5

cc57c91249af3c2e1095be3c872f4a86
SHA1

bfb2b936a4bc57c19582b3c6071d1bad1c5767ba
SHA256

2649d65bd971a74b63f9cc854134599ce6f3829f4f6fc56c105ca7eceea7cf66
SHA512

31ea2e1bd4e7ac8b5984f401583f3138b908bf8e9ddf07bc13efd5ddd0ae9dd3f2dacdbfb0a76283696afcff8eecbccd0cdcb32dcdff099dabde3220eec061d6
SSDEEP

6144:N7ag2fLXK6WsaAdBLDdfMosjCdqkn0C2VIQv/h1HufmQ4D:Neg2fzK6WsaA7dfMos+4BzP

Score

10^/10

redline dozk discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes

auth_value
9f1dc4ff242fb8b53742acae0ef96143

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/924-55-0x0000000002450000-0x00000000024AA000-memory.dmp	family_redline
behavioral1/memory/924-56-0x0000000004A70000-0x0000000004AC8000-memory.dmp	family_redline
behavioral1/memory/924-57-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-58-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-60-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-62-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-66-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-64-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-68-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-70-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-76-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-74-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-72-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-80-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-78-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-82-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-84-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-87-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-92-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-94-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-90-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-98-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-96-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-102-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-100-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-108-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-106-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-104-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-110-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-112-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-114-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-118-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-120-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-116-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline
behavioral1/memory/924-122-0x0000000004A70000-0x0000000004AC2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

924 file.exe
924 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 924 file.exe

pid	process
924	file.exe
924	file.exe

description	pid	process
Token: SeDebugPrivilege	924	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/924-55-0x0000000002450000-0x00000000024AA000-memory.dmp

Filesize
360KB

Download
memory/924-56-0x0000000004A70000-0x0000000004AC8000-memory.dmp

Filesize
352KB

Download
memory/924-57-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-58-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-60-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-62-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-66-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-64-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-68-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-70-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-76-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-74-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-72-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-80-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-78-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-82-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-84-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-86-0x0000000000300000-0x0000000000362000-memory.dmp

Filesize
392KB

Download
memory/924-88-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/924-87-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-92-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-94-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-90-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-98-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-96-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-102-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-100-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-108-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-106-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-104-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-110-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-112-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-114-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-118-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-120-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-116-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-122-0x0000000004A70000-0x0000000004AC2000-memory.dmp

Filesize
328KB

Download
memory/924-849-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing