redline | 877295a024136906d601c165783186d49b1d175b81a6caa99851eee3e35486c8

General

Target

e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe
Size

482KB
MD5

3f5bb3fc080ece9c6f87004c4f0b052a
SHA1

286da433d2ab965c7ac94a9ab8838ed74c5e5ee3
SHA256

e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0
SHA512

3dc0489ced9d15d485d0bf3a2c007841238691705e73e1d8a0549ec09e2b9e66488d953207c81cfea2ba1171d61a512a10c3f2bada8c5febdf2155f0c6c792a3
SSDEEP

12288:qubsNSOetfARQAPyGUfT+tkrhWJNOnMv77:qubsnafAPyjZrgnv77

Score

10^/10

redline 1149276168_99 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

1149276168_99

C2

https://pastebin.com/raw/8baCJyMF

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 1 IoCs

pid	Process
2244	setup_1693318291.792842.exe

Loads dropped DLL 3 IoCs

pid	Process
772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe
772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe
772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2392	2244	setup_1693318291.792842.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2392	AppLaunch.exe
2392	AppLaunch.exe
2392	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 772 wrote to memory of 2244	772	e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe	30
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32
PID 2244 wrote to memory of 2392	2244	setup_1693318291.792842.exe	32

C:\Users\Admin\AppData\Local\Temp\e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe
"C:\Users\Admin\AppData\Local\Temp\e1c5d328eaf0228e5d1ae9bf8ef3d6bf734f88dfb411cb5afa25d15f1f023ab0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar105D.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe

Filesize
348.0MB

MD5
f6da5cc2d8d9eb4ea83c8af1a1b2b298

SHA1
1cb73bcef1b9a7619a18e46790c4139cb51dc81a

SHA256
f94cc676b147c529ffdd986cc01ae5682dcce7650d03484c0ffbabb516ef9264

SHA512
bc6a0d0473d7ad9a54705d517184d5d04fb195b3993c95463d7b27dca3fb6fe5fbc0636ec842f68661b33ba73b8ea4c0da53e2ed9f750b85bb22df2916105203

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe

Filesize
351.8MB

MD5
151fa41ff36415c8a053a98e2513599b

SHA1
16eb80c0311c6fb5579b9f2e29efc8aba35bbe53

SHA256
354d29a5e391a56e8aae4f78ddf1207b7719a112b108507e5eb77709d7996632

SHA512
a3073e50f8b6c608e01fea765a04068c9845f3aa9de938864e55dec15fa49600f1f1f49262475f2e9c71d58abeab106f7fc85ffac4c0c571fb48a15f386e4351

Download Submit
\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe

Filesize
352.1MB

MD5
e97a565074552e3eeb41e08be90e2c69

SHA1
193a68614675d08ebb65994b5b4c977813439bb7

SHA256
3958d32b1e55d0e2bda82a3090bf3ba3ed6c76d0fac22e999e05f5fe7537e085

SHA512
aeeb15bcaa0b2180586a673e95228fa39b14e6c704204dd18b256b2ef5a28a549da421e9b28358b40c6ae5ccc3b6119ec4365a386c20394e19b455f25deecbc9

Download Submit
\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe

Filesize
352.6MB

MD5
080be61a90ddb9ca768575ddb06e55b3

SHA1
2619fb1b3061dc77f399c063b279dc1b8f12cbd2

SHA256
af4a0354bbc93026d980642425b3a6b9eb92950ebf9f8721e91eff16b46b8cf7

SHA512
4919ffd0004f02a420643a6ba7c921a6988ddf07006dba29ff2c8f8b8c68a75c37b48d219e28f36d1dcfc9a6f265b5d923765cf5de13b9cf232c28928713dfa9

Download Submit
\Users\Admin\AppData\Local\Temp\setup_1693318291.792842.exe

Filesize
347.4MB

MD5
166747727f1e52183afa61c958a33ace

SHA1
92f1f32686b65fd2566088befdfad3c562eaeb1d

SHA256
45fac5f4e49173175e8abaa7c00675dd7524f1ab956d5de8db9ef308d35995f9

SHA512
dd012230fc351ee65fc59d8d67a2515e07dbfea60c20ce0621c87b4e646c57f0c9748e14642320395e23527ecb1b9ac46706489f87b5c1d37555dc31d589b42e

Download Submit
memory/2392-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-23-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2392-24-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2392-20-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2392-62-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2392-63-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2392-64-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing