redline | ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649

General

Target

ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe
Size

327KB
MD5

500a46693ea76bfc26f7cfa6a2e84574
SHA1

fef494c31628d42d80e0803a10adbb32476bd317
SHA256

ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649
SHA512

5f7b24086ce20b35e0c4c2615e6d2461fc512ae1bf787dfdcf3a042c374ee101828aaff304fbb1889c667c641954462f995174d4c2961da7d27591b086e28956
SSDEEP

6144:MpdFlmluvoEBobXXF5CqgFuZvJ+I+pn2s5LjHgQcYqZQG6ko:Mp4EBobGWvegUZcf2G6ko

Score

10^/10

redline 5345987420 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

5345987420

C2

https://pastebin.com/raw/KE5Mft0T

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/8-1-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
12	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	4360	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe
8	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85
PID 4360 wrote to memory of 8	4360	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	85

C:\Users\Admin\AppData\Local\Temp\ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe
"C:\Users\Admin\AppData\Local\Temp\ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 276
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4360 -ip 4360
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-8-0x0000000006870000-0x00000000068AC000-memory.dmp

Filesize
240KB

Download
memory/8-10-0x0000000006BE0000-0x0000000006DA2000-memory.dmp

Filesize
1.8MB

Download
memory/8-2-0x000000007431E000-0x000000007431F000-memory.dmp

Filesize
4KB

Download
memory/8-3-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/8-4-0x0000000006010000-0x0000000006628000-memory.dmp

Filesize
6.1MB

Download
memory/8-5-0x0000000005A70000-0x0000000005A82000-memory.dmp

Filesize
72KB

Download
memory/8-6-0x0000000005BA0000-0x0000000005CAA000-memory.dmp

Filesize
1.0MB

Download
memory/8-7-0x0000000074310000-0x0000000074AC0000-memory.dmp

Filesize
7.7MB

Download
memory/8-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/8-18-0x0000000074310000-0x0000000074AC0000-memory.dmp

Filesize
7.7MB

Download
memory/8-9-0x00000000068B0000-0x00000000068FC000-memory.dmp

Filesize
304KB

Download
memory/8-11-0x00000000072E0000-0x000000000780C000-memory.dmp

Filesize
5.2MB

Download
memory/8-12-0x0000000007DC0000-0x0000000008364000-memory.dmp

Filesize
5.6MB

Download
memory/8-13-0x0000000006DB0000-0x0000000006E42000-memory.dmp

Filesize
584KB

Download
memory/8-14-0x0000000007190000-0x0000000007206000-memory.dmp

Filesize
472KB

Download
memory/8-15-0x0000000006FA0000-0x0000000006FBE000-memory.dmp

Filesize
120KB

Download
memory/8-16-0x0000000007260000-0x00000000072B0000-memory.dmp

Filesize
320KB

Download
memory/4360-0-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing