redline | 9f8a1f56a75fcbae6a2a52fe6e74f00585e28b6aa8c02e380fb9a114d218c1d3

General

Target

Rrobknnz-TORRENTOLD.exe
Size

2.3MB
MD5

48545b3a32bc83046785f5ef2cacb8f7
SHA1

9e8cdfd6e5497c7a5b16792824fc5c9489c559b5
SHA256

9f8a1f56a75fcbae6a2a52fe6e74f00585e28b6aa8c02e380fb9a114d218c1d3
SHA512

8a6c5643f27967e2998ce93ceb57c9289ea0cf63d3d673b3f3a6b0815c3e87ac52eb7d3fab108a1d1a6bb6fbd106c43c33bde1817f697eb8301ff74f2c696aa9
SSDEEP

49152:/UFOFLvCJx9fOaBHeFLlpiS66XNhyuOGbZZbw7:/VFGJx9GtBpiSFNiGE7

Score

10^/10

redline torrentold infostealer

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

C2

amrican-sport-live-stream.cc:4581

Attributes

auth_value
74e1b58bf920611f04c0e3919954fe05

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/552-13222-0x0000000000400000-0x0000000000444000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

Rrobknnz-TORRENTOLD.exe

description pid process target process

PID 580 set thread context of 552 580 Rrobknnz-TORRENTOLD.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Rrobknnz-TORRENTOLD.exe

description pid process

Token: SeDebugPrivilege 580 Rrobknnz-TORRENTOLD.exe

description	pid	process	target process
PID 580 set thread context of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	580	Rrobknnz-TORRENTOLD.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Rrobknnz-TORRENTOLD.exe

description	pid	process	target process
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe
PID 580 wrote to memory of 552	580	Rrobknnz-TORRENTOLD.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Rrobknnz-TORRENTOLD.exe
"C:\Users\Admin\AppData\Local\Temp\Rrobknnz-TORRENTOLD.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-13222-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/552-13224-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/552-13223-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/580-88-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-56-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-60-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-92-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-68-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-66-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-64-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-70-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-78-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-76-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-74-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-72-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-82-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-84-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-80-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-86-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-90-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-54-0x0000000001200000-0x000000000144E000-memory.dmp

Filesize
2.3MB

Download
memory/580-62-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-58-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/580-94-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-96-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-102-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-104-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-100-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-108-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-110-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-106-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-112-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-114-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-118-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-116-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-120-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-1208-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/580-57-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-98-0x00000000053A0000-0x0000000005589000-memory.dmp

Filesize
1.9MB

Download
memory/580-55-0x00000000053A0000-0x000000000558E000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing