redline | 06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8

General

Target

06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe
Size

291KB
MD5

adb28cd25314fdc12381be289659c7c2
SHA1

76e41067acc39d16675a220393ff5cca266568b2
SHA256

06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8
SHA512

aa725bd23e270833196f86aec66df9d98a6559cf409629e7d3bb2b6716309a38a87e523e8803d2314249ce013f3488400b917531aa17ed101bd2b3e90a622b12
SSDEEP

6144:dgj65uK85+l1rwUX2O/8GXGiB+DnIPe6BY5j:O0uKogKOEGXtSO3ij

Score

10^/10

redline @chicago discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@chicago

C2

185.11.61.125:22344

Attributes

auth_value
21f863e0cbd09d0681058e068d0d1d7f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/456-139-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-140-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-142-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-144-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-146-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-148-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-150-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-152-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-154-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-156-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-158-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-160-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-162-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-164-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-166-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-168-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-170-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-172-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-174-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-176-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-178-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-180-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-182-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-184-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-186-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-188-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-190-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-192-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-194-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-196-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-198-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-200-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline
behavioral1/memory/456-202-0x0000000004C10000-0x0000000004C62000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 456 WerFault.exe 06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

pid process

456 06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

description pid process

Token: SeDebugPrivilege 456 06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

pid	pid_target	process	target process
1904	456	WerFault.exe	06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

pid	process
456	06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

description	pid	process
Token: SeDebugPrivilege	456	06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe

C:\Users\Admin\AppData\Local\Temp\06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe
"C:\Users\Admin\AppData\Local\Temp\06112ee653f05a595f7bdbdd5872e6868e0b04a7b546c34b35c3f41a192f03f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1080
2⤵
- Program crash
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 456 -ip 456
1⤵
PID:4256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-134-0x00000000021E0000-0x0000000002242000-memory.dmp

Filesize
392KB

Download
memory/456-135-0x0000000004DC0000-0x0000000005364000-memory.dmp

Filesize
5.6MB

Download
memory/456-136-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-137-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-138-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-139-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-140-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-142-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-144-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-146-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-148-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-150-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-152-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-154-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-156-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-158-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-160-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-162-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-164-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-166-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-168-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-170-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-172-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-174-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-176-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-178-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-180-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-182-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-184-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-186-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-188-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-190-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-192-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-194-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-196-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-198-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-200-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-202-0x0000000004C10000-0x0000000004C62000-memory.dmp

Filesize
328KB

Download
memory/456-929-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/456-930-0x0000000004D00000-0x0000000004D12000-memory.dmp

Filesize
72KB

Download
memory/456-931-0x0000000005990000-0x0000000005A9A000-memory.dmp

Filesize
1.0MB

Download
memory/456-932-0x0000000004D20000-0x0000000004D5C000-memory.dmp

Filesize
240KB

Download
memory/456-933-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-934-0x0000000005D20000-0x0000000005D86000-memory.dmp

Filesize
408KB

Download
memory/456-935-0x00000000063F0000-0x0000000006482000-memory.dmp

Filesize
584KB

Download
memory/456-936-0x00000000065A0000-0x0000000006616000-memory.dmp

Filesize
472KB

Download
memory/456-937-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download
memory/456-938-0x0000000006720000-0x00000000068E2000-memory.dmp

Filesize
1.8MB

Download
memory/456-939-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Filesize
5.2MB

Download
memory/456-943-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-942-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/456-944-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing