redline | 76d61da3a00ec5c207ec8361b06f4820902880fb6dbd3a203da1c462e98db594

General

Target

Redline_Cleaned.exe
Size

21.8MB
MD5

916679d6fde50b5153e6c44c30beeffd
SHA1

a6ef5a0ef603cea314f5cdba904798c378286885
SHA256

76d61da3a00ec5c207ec8361b06f4820902880fb6dbd3a203da1c462e98db594
SHA512

b39f3ce958bca9d2b2dbc96dbb2907d38c142f8f61913e4f524d854109987dcae584838b6736b9e1301df62c1873e4a4e864038aaa965fe4177662d869abe53b
SSDEEP

3072:ISurFVcSIcp28GMoqcxJ/Z6e1yWuyWxEjGbU18Z4JjAoEN/2RIMDfn5n6Dp0EBhH:mX0F86lue1jWWIZ5oEbMDfJG9

Score

10^/10

redline yt infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

yt

C2

65.109.161.165:6997

Attributes

auth_value
c85b149d6d3359b3fe4dd1dfcc5864e8

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Redline_Cleaned.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Redline_Cleaned.exe

Executes dropped EXE 1 IoCs

Processes:

bin do.exe

pid process

492 bin do.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Redline_Cleaned.exe

description pid process target process

PID 652 set thread context of 2252 652 Redline_Cleaned.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

2252 vbc.exe
2252 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 2252 vbc.exe

pid	process
492	bin do.exe

description	pid	process	target process
PID 652 set thread context of 2252	652	Redline_Cleaned.exe	vbc.exe

pid	process
2252	vbc.exe
2252	vbc.exe

description	pid	process
Token: SeDebugPrivilege	2252	vbc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Redline_Cleaned.exe

description	pid	process	target process
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 2252	652	Redline_Cleaned.exe	vbc.exe
PID 652 wrote to memory of 492	652	Redline_Cleaned.exe	bin do.exe
PID 652 wrote to memory of 492	652	Redline_Cleaned.exe	bin do.exe
PID 652 wrote to memory of 492	652	Redline_Cleaned.exe	bin do.exe

C:\Users\Admin\AppData\Local\Temp\Redline_Cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_Cleaned.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Users\Admin\AppData\Local\Temp\bin do.exe
"C:\Users\Admin\AppData\Local\Temp\bin do.exe"
2⤵
- Executes dropped EXE
PID:492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bin do.exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin do.exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin do.exe
Filesize
3KB

MD5
43c14a07b0a83cb0ade9f7da7b0ca394

SHA1
79d457fc5c171c3677c50d19e7df3baf5f1311a8

SHA256
3069063f04fc8c45fc2c84743a085bcfcbe2df9642c0518a1a185549ab9dfc36

SHA512
9bfefb852eec35916aefe50d6a50731b2fbf5eb87f6cb64d2fc3d4b8e86107b2687d75a5ed169972a8574f1df72f21336ccd427446519edcb2cc65c75e025a0c

Download Submit
memory/492-149-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/652-134-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/652-133-0x0000000000D20000-0x0000000000DB2000-memory.dmp

Filesize
584KB

Download
memory/2252-153-0x00000000034B0000-0x00000000034C0000-memory.dmp

Filesize
64KB

Download
memory/2252-156-0x000000000B0A0000-0x000000000B132000-memory.dmp

Filesize
584KB

Download
memory/2252-151-0x000000000ACF0000-0x000000000ADFA000-memory.dmp

Filesize
1.0MB

Download
memory/2252-152-0x000000000AC10000-0x000000000AC22000-memory.dmp

Filesize
72KB

Download
memory/2252-135-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2252-154-0x000000000AC70000-0x000000000ACAC000-memory.dmp

Filesize
240KB

Download
memory/2252-155-0x000000000AF80000-0x000000000AFF6000-memory.dmp

Filesize
472KB

Download
memory/2252-148-0x000000000B200000-0x000000000B818000-memory.dmp

Filesize
6.1MB

Download
memory/2252-157-0x000000000BDD0000-0x000000000C374000-memory.dmp

Filesize
5.6MB

Download
memory/2252-158-0x000000000B140000-0x000000000B1A6000-memory.dmp

Filesize
408KB

Download
memory/2252-159-0x00000000034B0000-0x00000000034C0000-memory.dmp

Filesize
64KB

Download
memory/2252-160-0x000000000C4D0000-0x000000000C520000-memory.dmp

Filesize
320KB

Download
memory/2252-161-0x000000000C6F0000-0x000000000C8B2000-memory.dmp

Filesize
1.8MB

Download
memory/2252-162-0x000000000D5B0000-0x000000000DADC000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing