redline | eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410

General

Target

eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410.exe
Size

297KB
MD5

e762662419fc71135555c792a7ec9d59
SHA1

714f3eb1fac0b49ed395e6db6bb314721a96997f
SHA256

eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410
SHA512

8f8064d7d048b52ac5a9afc3e8c8de3d131c751667893f15344c03f2055255c6887ca9225ca52028488a57eb70ff648884a71ca05b3f916368a10c0bc10e3d0d
SSDEEP

6144:UvHwCMbovF9JUKbHGTRfcfX1m3fbGKUBjcFPx76COzuS92:UPwCMbovF9JUKrGTRVCKajcfgzu

Score

10^/10

redline 1 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes

auth_value
ec6ada170bcec2e72f0e1f3954547f73

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1712-1-0x0000000004560000-0x0000000004594000-memory.dmp	family_redline
behavioral1/memory/1712-2-0x00000000046E0000-0x0000000004712000-memory.dmp	family_redline
behavioral1/memory/1712-3-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-4-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-6-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-8-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-10-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-12-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-14-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-16-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-18-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-20-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-22-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-24-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-26-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-30-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-32-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-38-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-36-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-40-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-34-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-28-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-42-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-44-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-46-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-48-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-50-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-52-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-54-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-56-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-58-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-60-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-64-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-62-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline
behavioral1/memory/1712-66-0x00000000046E0000-0x000000000470C000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410.exe

C:\Users\Admin\AppData\Local\Temp\eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410.exe
"C:\Users\Admin\AppData\Local\Temp\eb1b07e39c8294d1c58b3e21745fae82bb0aaed9b635ce70670afcb2266bd410.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000077A30000-0x0000000077BD9000-memory.dmp

Filesize
1.7MB

Download
memory/1712-1-0x0000000004560000-0x0000000004594000-memory.dmp

Filesize
208KB

Download
memory/1712-2-0x00000000046E0000-0x0000000004712000-memory.dmp

Filesize
200KB

Download
memory/1712-3-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-4-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-6-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-8-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-10-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-12-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-14-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-16-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-18-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-20-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-22-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-24-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-26-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-30-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-32-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-38-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-36-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-40-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-34-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-28-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-42-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-44-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-46-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-48-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-50-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-52-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-54-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-56-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-58-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-60-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-64-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-62-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download
memory/1712-66-0x00000000046E0000-0x000000000470C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing