redline | 6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede

General

Target

6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe
Size

680KB
MD5

eb645f8f32bbc89719efdaca72a7c23d
SHA1

e37fda78264c0a16f8dc9218e263d1ba0c6f31d8
SHA256

6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede
SHA512

99c8bcd5d1dc206382443c172a1c07d4ddf64aec09507a0a242f86a75ec1efc26f3a8168ec53f75bd7c74511439fb079298d3b38b07d691e79e78bc3e30f4687
SSDEEP

12288:QfyqTX/MaLX00zFTu7XqnvsWgxVd7WgogJDSGr9Y1KrE:Wnz566vOMg3gmjE

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3012-10-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/3012-11-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/3012-17-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/3012-18-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/3012-19-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 460 set thread context of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe
460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28
PID 460 wrote to memory of 3012	460	6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe	28

C:\Users\Admin\AppData\Local\Temp\6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe
"C:\Users\Admin\AppData\Local\Temp\6b8a6e03207ee1a61bb14656de34bbe9a1eb13ad9ab350c090d7b65397642ede.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-0-0x00000000013D0000-0x0000000001480000-memory.dmp

Filesize
704KB

Download
memory/460-1-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/460-2-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/460-3-0x00000000012C0000-0x0000000001304000-memory.dmp

Filesize
272KB

Download
memory/460-4-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/460-5-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/460-6-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/460-21-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/460-16-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/460-15-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-11-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3012-10-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-9-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-17-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-18-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-19-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-20-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-7-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3012-22-0x00000000072F0000-0x0000000007330000-memory.dmp

Filesize
256KB

Download
memory/3012-23-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing