redline | 5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5

General

Target

5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe
Size

290KB
MD5

afe2c8ea0a7e1972ff9948a08b1522cd
SHA1

17b3192cafef0f8f8b7854fa9638d90310c507a0
SHA256

5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5
SHA512

6c331b2068e2e5087e5ef274e0bde5691731cad58d4eb667b008dd063a9d3a15011b184065413139890b6b34ab92f3675bdf895349d23b8b2dbcef9c15d3d94e
SSDEEP

3072:erI7cfSYodS0fCYUx4y1cRTMkuqCYkshoAtncAr2fZAMttTvh+xf8r/gQ+mHUDrK:NdS0f14csjY5hoAtlr2io+DQ+m9ea

Score

10^/10

redline infostealer spyware

Malware Config

Extracted

Family

redline

C2

135.181.173.163:4325

Attributes

auth_value
a909e2aaecf96137978fea4f86400b9b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 1864 set thread context of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3760	2292	WerFault.exe	81
4384	1864	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1852	AppLaunch.exe
1852	AppLaunch.exe
3280	AppLaunch.exe
3280	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	AppLaunch.exe
Token: SeDebugPrivilege	3280	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 2292 wrote to memory of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 2292 wrote to memory of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 2292 wrote to memory of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 2292 wrote to memory of 1852	2292	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	83
PID 1864 wrote to memory of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100
PID 1864 wrote to memory of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100
PID 1864 wrote to memory of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100
PID 1864 wrote to memory of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100
PID 1864 wrote to memory of 3280	1864	5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe	100

C:\Users\Admin\AppData\Local\Temp\5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe
"C:\Users\Admin\AppData\Local\Temp\5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 272
  2⤵
  - Program crash
  PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2292 -ip 2292
1⤵
PID:3156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:744

C:\Users\Admin\AppData\Local\Temp\5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe
"C:\Users\Admin\AppData\Local\Temp\5eb4e881de8b7d561c633938b6565e45c7dedce721264c677cdff347a00baed5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 140
  2⤵
  - Program crash
  PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\778673905\zmstage.exe
"C:\Users\Admin\AppData\Local\Temp\778673905\zmstage.exe"
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
2KB

MD5
09f87ebf033076d4019bf0a9ee1eb2e9

SHA1
b6f912c024056fd8b8353010f948dcbf3836e54a

SHA256
e9328bdf85ab57bacc3b598afe0f3f5da4bab5fbe43f60a8e11df110ecbb949a

SHA512
c7fd8c5b4a770a85c96da0b4dda5953398456f0d5ed9164b0d795835b338e6e5bb194dbfdde25372813e651730da3ccbd4eacd18f9a8524aa804209fb38d5618

Download Submit
memory/1852-143-0x0000000006870000-0x0000000006E14000-memory.dmp

Filesize
5.6MB

Download
memory/1852-145-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/1852-140-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/1852-141-0x0000000005700000-0x0000000005712000-memory.dmp

Filesize
72KB

Download
memory/1852-142-0x0000000005760000-0x000000000579C000-memory.dmp

Filesize
240KB

Download
memory/1852-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1852-144-0x00000000062C0000-0x0000000006352000-memory.dmp

Filesize
584KB

Download
memory/1852-139-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/1852-146-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/1852-147-0x0000000007140000-0x0000000007302000-memory.dmp

Filesize
1.8MB

Download
memory/1852-148-0x0000000008020000-0x000000000854C000-memory.dmp

Filesize
5.2MB

Download
memory/1852-138-0x0000000005CA0000-0x00000000062B8000-memory.dmp

Filesize
6.1MB

Download
memory/3280-156-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/3280-157-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing