redline | 16b9de721ea56289be73a2b2bcadb5d11ccc2ae56b878170b24bc0df06632654

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 01:00

Target

4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe
Size

1.1MB
MD5

0035b4c88aab20d9887ef58facbb36d6
SHA1

1a2be527b223ae859891013db6b528b4a74ce00d
SHA256

4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f
SHA512

e3614150aae317acc47e04574c8e03896679a2efaef1627979bfca9ba84ecaeb91828c1310d3f93d1400b9b30532fc88a478f946b25592cfe07f9d8e9b446624
SSDEEP

6144:1KJd0TaLFcKmbPvyR+yKBAOns5VXfkSgIAHK2X+rHMxuh6KM/tPyUiM:1VTaLFcKm2cfqVvkSgIgGrh8RyUiM

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/1072-54-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1072-58-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1072-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1072	InstallUtil.exe
1072	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28
PID 972 wrote to memory of 1072	972	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	28

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1072-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1072-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1072-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1072-59-0x0000000006DC0000-0x0000000006E00000-memory.dmp

Filesize
256KB

Download