redline | 63fa3c9886f2ecbfa8c4cd602e3862884d49f63e5c72d5e36314f5b1945bd18e

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-05-2023 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

168KB
MD5

6f33cee4a80c10629b381a27e2cd4c7e
SHA1

2e2b1aff25bc95d4c66da23ae8d46e5cfd888afb
SHA256

63fa3c9886f2ecbfa8c4cd602e3862884d49f63e5c72d5e36314f5b1945bd18e
SHA512

8f932ffceb5517009328f1f71a5959b75ed026150943bd6697e01d971437e3262ee36ce73ddcd6e45cc2ebded0a9328dfed153fafe801ffa36d38a60437d8eca
SSDEEP

1536:hcKy3rBJqlVZRGWYdzrDtBg4Pk175BuD47TGqVWbuX01x+1N1V4183wYkU8e8hu:zA9DjsNkbqViT141N1V41S8e8hu

Score

10^/10

redline all discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

all

185.225.74.51:44767

Attributes

auth_value
c8891867d2974a449a3a05f4ae6cc2fd

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

1416 file.exe
1416 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1416 file.exe

pid	process
1416	file.exe
1416	file.exe

description	pid	process
Token: SeDebugPrivilege	1416	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x00000000013E0000-0x0000000001410000-memory.dmp

Filesize
192KB

Download
memory/1416-55-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1416-56-0x0000000000C70000-0x0000000000CB0000-memory.dmp

Filesize
256KB

Download