redline | 6a4e611067897fb1deef968b156672bfb0bb4098c9bcc65d1fbbd7cf24a656ad

General

Target

3ad366b1f91d3b4837b5df220612a06b.exe
Size

991KB
MD5

3ad366b1f91d3b4837b5df220612a06b
SHA1

9db9c2b3bcaf91490dbadcd92e58d7ea9126a636
SHA256

6a4e611067897fb1deef968b156672bfb0bb4098c9bcc65d1fbbd7cf24a656ad
SHA512

dda9a7c28305f11c1cde6eb7dfa61c44ed64200a7d4ce0f503899f1b0607bd3b0fca256b3231430d926c84ba10101ef7af8627e0e69299ef400831ad74ebbe32
SSDEEP

12288:LfWyu528tXTCceAzbGmCzMPFHp9k1cKzb5yPcVfGLxBgQW57PNiLsNuXJHsGX0o3:E629k6KzbgPWfGLxB6576lEoI/xQX3R7

Score

10^/10

redline infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1848-83-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1848-84-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1848-86-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1848-88-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1848-90-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	MsBuild.exe
1848	MsBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	3ad366b1f91d3b4837b5df220612a06b.exe
Token: SeDebugPrivilege	1848	MsBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29
PID 996 wrote to memory of 1848	996	3ad366b1f91d3b4837b5df220612a06b.exe	29

C:\Users\Admin\AppData\Local\Temp\3ad366b1f91d3b4837b5df220612a06b.exe
"C:\Users\Admin\AppData\Local\Temp\3ad366b1f91d3b4837b5df220612a06b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x0000000000800000-0x00000000008FC000-memory.dmp

Filesize
1008KB

Download
memory/996-55-0x0000000004800000-0x0000000004870000-memory.dmp

Filesize
448KB

Download
memory/996-56-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/996-57-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-58-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-60-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-62-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-64-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-66-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-68-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-70-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-72-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-74-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-76-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-78-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/996-80-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/1848-81-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-82-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-83-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-84-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-85-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1848-86-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-88-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-90-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1848-91-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing