redline | 16b9de721ea56289be73a2b2bcadb5d11ccc2ae56b878170b24bc0df06632654

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 01:00

Target

4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe
Size

1.1MB
MD5

0035b4c88aab20d9887ef58facbb36d6
SHA1

1a2be527b223ae859891013db6b528b4a74ce00d
SHA256

4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f
SHA512

e3614150aae317acc47e04574c8e03896679a2efaef1627979bfca9ba84ecaeb91828c1310d3f93d1400b9b30532fc88a478f946b25592cfe07f9d8e9b446624
SSDEEP

6144:1KJd0TaLFcKmbPvyR+yKBAOns5VXfkSgIAHK2X+rHMxuh6KM/tPyUiM:1VTaLFcKm2cfqVvkSgIgGrh8RyUiM

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5096-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	InstallUtil.exe
5096	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82
PID 2296 wrote to memory of 5096	2296	4b96a2bc629d40819ad85f26579a704999ca4e9d544ee83e7e89752c7279891f.exe	82

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/5096-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5096-134-0x0000000007E20000-0x0000000008438000-memory.dmp

Filesize
6.1MB

Download
memory/5096-135-0x0000000007820000-0x0000000007832000-memory.dmp

Filesize
72KB

Download
memory/5096-136-0x0000000007950000-0x0000000007A5A000-memory.dmp

Filesize
1.0MB

Download
memory/5096-137-0x0000000007880000-0x00000000078BC000-memory.dmp

Filesize
240KB

Download
memory/5096-138-0x0000000007BB0000-0x0000000007BC0000-memory.dmp

Filesize
64KB

Download
memory/5096-139-0x0000000007C30000-0x0000000007C96000-memory.dmp

Filesize
408KB

Download
memory/5096-140-0x00000000087E0000-0x0000000008872000-memory.dmp

Filesize
584KB

Download
memory/5096-141-0x0000000008E30000-0x00000000093D4000-memory.dmp

Filesize
5.6MB

Download
memory/5096-142-0x0000000008880000-0x00000000088F6000-memory.dmp

Filesize
472KB

Download
memory/5096-143-0x0000000008BB0000-0x0000000008D72000-memory.dmp

Filesize
1.8MB

Download
memory/5096-144-0x0000000009910000-0x0000000009E3C000-memory.dmp

Filesize
5.2MB

Download
memory/5096-145-0x0000000008A00000-0x0000000008A1E000-memory.dmp

Filesize
120KB

Download
memory/5096-146-0x0000000008B60000-0x0000000008BB0000-memory.dmp

Filesize
320KB

Download