redline | 3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b

General

Target

3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe
Size

553KB
MD5

1c7fa29f87c23abfa490a5e8909a310a
SHA1

35c09cc093085c3924cab4c34572387d920ac185
SHA256

3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b
SHA512

5fce78d4a06352a5937b14b4a877be7a32874fc27e0f5dc409a1bddcd5526e534cf3f416a58b8e4de0a559043b0be4bfb57146b1682ba33806f47141b1cdb5dd
SSDEEP

12288:+CFjaM7SlWi+CqGndxB0T7JfdI0n3cTS+T54zfR2x/a/A2vz4UTKZLmRmV/MeiWE:+CtaM7kN+v4Fk7JfwuP

Score

10^/10

redline 7371156009_99 credential_access discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

7371156009_99

C2

https://t.me/+J_Z1QGHfHko0MGZi

https://steamcommunity.com/id/elcadillac

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4516-9-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Loads dropped DLL 1 IoCs

pid	Process
3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe
4516	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88
PID 3932 wrote to memory of 4516	3932	3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe	88

C:\Users\Admin\AppData\Local\Temp\3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe
"C:\Users\Admin\AppData\Local\Temp\3e0b58b606aeb4cbf53aa42f471ae31960309cb01e2a3872b1db400c9694012b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
279KB

MD5
1dbbd0b6af7f9543b6b930b58b089d74

SHA1
8ce8939d95775affcd2cbf70dc9e078f77e2f7c8

SHA256
55647921432f0dfcf2e4a8455294df3be736c133beaa58c977c18b49503984ce

SHA512
d4424575c5659b8c5966c3a1692df1416961fa4a8bd6407fa8722ee70f533908cdb5a3875d3d0fa06672db3f2e5d9e8add1c1b33cc2232cde12a9a91340b5a98

Download Submit
memory/3932-0-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/3932-1-0x0000000000B80000-0x0000000000C10000-memory.dmp

Filesize
576KB

Download
memory/3932-2-0x0000000002EB0000-0x0000000002EB6000-memory.dmp

Filesize
24KB

Download
memory/3932-29-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/3932-11-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4516-16-0x00000000054F0000-0x00000000055FA000-memory.dmp

Filesize
1.0MB

Download
memory/4516-21-0x0000000006D70000-0x000000000729C000-memory.dmp

Filesize
5.2MB

Download
memory/4516-14-0x0000000005980000-0x0000000005F98000-memory.dmp

Filesize
6.1MB

Download
memory/4516-15-0x00000000053C0000-0x00000000053D2000-memory.dmp

Filesize
72KB

Download
memory/4516-12-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4516-17-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4516-18-0x00000000062E0000-0x000000000631C000-memory.dmp

Filesize
240KB

Download
memory/4516-19-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/4516-20-0x0000000006670000-0x0000000006832000-memory.dmp

Filesize
1.8MB

Download
memory/4516-13-0x0000000004E60000-0x0000000004EC6000-memory.dmp

Filesize
408KB

Download
memory/4516-22-0x0000000007850000-0x0000000007DF4000-memory.dmp

Filesize
5.6MB

Download
memory/4516-23-0x0000000006840000-0x00000000068D2000-memory.dmp

Filesize
584KB

Download
memory/4516-24-0x00000000068E0000-0x0000000006930000-memory.dmp

Filesize
320KB

Download
memory/4516-25-0x0000000006930000-0x00000000069A6000-memory.dmp

Filesize
472KB

Download
memory/4516-26-0x0000000006A50000-0x0000000006A6E000-memory.dmp

Filesize
120KB

Download
memory/4516-28-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4516-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing