redline | a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab

General

Target

a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe
Size

314KB
MD5

42dac6b34d7f5956fb0a1c406a01f8c6
SHA1

820a6107369008fdfc308dac062cb2b40423f75c
SHA256

a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab
SHA512

4b06bcc049b4c67bbb7b7986606bbf9dbec65d4f654564bdb01bd27ab6bf693cff0c76bcb1da6eb45213e306eee70b62666ba4b00e71e4fe62c2e35a0de35777
SSDEEP

6144:Pnf66jtwKLxtknmZxmnTM/75nOpiSB5vtGkBM5zRP:vthnL8nmZ2y74DvtBm

Score

10^/10

redline @germany discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@Germany

C2

185.11.61.125:22344

Attributes

auth_value
9d15d78194367a949e54a07d6ce02c62

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1652-136-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-137-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-139-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-141-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-143-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-145-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-147-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-149-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-151-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-154-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-158-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-160-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-162-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-164-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-166-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-168-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-170-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-172-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-174-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-176-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-178-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-180-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-182-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-184-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-186-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-188-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-190-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-192-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-194-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-196-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-198-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-200-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline
behavioral1/memory/1652-202-0x00000000051A0000-0x00000000051F2000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 1652 WerFault.exe a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

pid process

1652 a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

description pid process

Token: SeDebugPrivilege 1652 a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

pid	pid_target	process	target process
2460	1652	WerFault.exe	a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

pid	process
1652	a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

description	pid	process
Token: SeDebugPrivilege	1652	a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe

C:\Users\Admin\AppData\Local\Temp\a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe
"C:\Users\Admin\AppData\Local\Temp\a2e1d1865518de8e9cee12db059a876887fc44f2d3a77cc44a7184bcefe2e2ab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 1848
2⤵
- Program crash
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1652 -ip 1652
1⤵
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-134-0x00000000021F0000-0x0000000002252000-memory.dmp

Filesize
392KB

Download
memory/1652-135-0x0000000004BF0000-0x0000000005194000-memory.dmp

Filesize
5.6MB

Download
memory/1652-136-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-137-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-139-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-141-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-143-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-145-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-147-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-149-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-151-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-154-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-155-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1652-157-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1652-153-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1652-158-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-160-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-162-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-164-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-166-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-168-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-170-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-172-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-174-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-176-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-178-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-180-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-182-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-184-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-186-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-188-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-190-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-192-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-194-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-196-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-198-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-200-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-202-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/1652-929-0x0000000005220000-0x0000000005838000-memory.dmp

Filesize
6.1MB

Download
memory/1652-930-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/1652-931-0x0000000005900000-0x0000000005A0A000-memory.dmp

Filesize
1.0MB

Download
memory/1652-932-0x0000000005A10000-0x0000000005A4C000-memory.dmp

Filesize
240KB

Download
memory/1652-933-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1652-934-0x0000000005D20000-0x0000000005D86000-memory.dmp

Filesize
408KB

Download
memory/1652-935-0x0000000006630000-0x00000000066C2000-memory.dmp

Filesize
584KB

Download
memory/1652-936-0x00000000066E0000-0x0000000006756000-memory.dmp

Filesize
472KB

Download
memory/1652-937-0x00000000067A0000-0x00000000067BE000-memory.dmp

Filesize
120KB

Download
memory/1652-938-0x0000000006840000-0x0000000006A02000-memory.dmp

Filesize
1.8MB

Download
memory/1652-939-0x0000000006A20000-0x0000000006F4C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing