redline | 6439c8e94bd2398ad15bd8cbf86a9ca9528cecf77506357e894a359880282724

General

Target

AA85F3E75E675FC1684BB5742C147E49.exe
Size

748KB
MD5

aa85f3e75e675fc1684bb5742c147e49
SHA1

a91a25b8af80ad692c209869f9a611ade301b8a9
SHA256

6439c8e94bd2398ad15bd8cbf86a9ca9528cecf77506357e894a359880282724
SHA512

639be242cc7e14dc03f15ebc217859364e3d20549d36ae26eb0c039a243ca467988a246308a2e4dce14bd8dd398e854c4e5ec549fff5d4a2a5c96abc3725479e
SSDEEP

12288:dpl9Z7a0GM4Rb9So1JELBYaKMwbQqbYpOMAauEa3MBy1IkML6ChV29jD+D+eIvvz:hawLQQTUIuEa82+GChc9j0zAx62QcNb

Score

10^/10

redline bot discovery execution infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Bot

C2

87.120.120.22:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2860-30-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2860-28-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2860-25-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2860-23-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2860-29-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Redline family
redline

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe
2932	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA85F3E75E675FC1684BB5742C147E49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA85F3E75E675FC1684BB5742C147E49.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2628	AA85F3E75E675FC1684BB5742C147E49.exe
2628	AA85F3E75E675FC1684BB5742C147E49.exe
2628	AA85F3E75E675FC1684BB5742C147E49.exe
2628	AA85F3E75E675FC1684BB5742C147E49.exe
2780	powershell.exe
2932	powershell.exe
2860	AA85F3E75E675FC1684BB5742C147E49.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	AA85F3E75E675FC1684BB5742C147E49.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2860	AA85F3E75E675FC1684BB5742C147E49.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2780	2628	AA85F3E75E675FC1684BB5742C147E49.exe	31
PID 2628 wrote to memory of 2780	2628	AA85F3E75E675FC1684BB5742C147E49.exe	31
PID 2628 wrote to memory of 2780	2628	AA85F3E75E675FC1684BB5742C147E49.exe	31
PID 2628 wrote to memory of 2780	2628	AA85F3E75E675FC1684BB5742C147E49.exe	31
PID 2628 wrote to memory of 2932	2628	AA85F3E75E675FC1684BB5742C147E49.exe	33
PID 2628 wrote to memory of 2932	2628	AA85F3E75E675FC1684BB5742C147E49.exe	33
PID 2628 wrote to memory of 2932	2628	AA85F3E75E675FC1684BB5742C147E49.exe	33
PID 2628 wrote to memory of 2932	2628	AA85F3E75E675FC1684BB5742C147E49.exe	33
PID 2628 wrote to memory of 2952	2628	AA85F3E75E675FC1684BB5742C147E49.exe	34
PID 2628 wrote to memory of 2952	2628	AA85F3E75E675FC1684BB5742C147E49.exe	34
PID 2628 wrote to memory of 2952	2628	AA85F3E75E675FC1684BB5742C147E49.exe	34
PID 2628 wrote to memory of 2952	2628	AA85F3E75E675FC1684BB5742C147E49.exe	34
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37
PID 2628 wrote to memory of 2860	2628	AA85F3E75E675FC1684BB5742C147E49.exe	37

C:\Users\Admin\AppData\Local\Temp\AA85F3E75E675FC1684BB5742C147E49.exe
"C:\Users\Admin\AppData\Local\Temp\AA85F3E75E675FC1684BB5742C147E49.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AA85F3E75E675FC1684BB5742C147E49.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hqYERKfni.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hqYERKfni" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE62.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\AA85F3E75E675FC1684BB5742C147E49.exe
  "C:\Users\Admin\AppData\Local\Temp\AA85F3E75E675FC1684BB5742C147E49.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE62.tmp

Filesize
1KB

MD5
a58f91f92b3a58a47b7822aaf2714fd5

SHA1
904157ee6ed3fa277b46a87ba82429697d9d7c25

SHA256
1e9b4d31149c62373bc68328e824e53d61dee459ffa1b525bdba13dbfd1ce9f2

SHA512
3e2f738afd884de2ed1f7925cd6ee32d069fd742ca50279c5dec4b1340790e5e07fd28cc356981b031008ca65445a9c7fc8a48a7d0830b426a80d75391fad404

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
38226956dd20cbf449593d2afc20f418

SHA1
e30fc873574d979ae88bc651dba539b7b325c643

SHA256
3a16a89e65f15a05e114fb40bf60eef48098ebb7f761ee6f8c03ed7f262a6141

SHA512
8f565200c0c06b6c0c227989145403cd2da67d9bb14f1c528d1ec06853c6bed6c6d378aae69e8cc039985c5bfff99fc60e67b2d2f6de005e26799fd09848b79e

Download Submit
memory/2628-4-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/2628-31-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/2628-5-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-6-0x0000000000CA0000-0x0000000000D36000-memory.dmp

Filesize
600KB

Download
memory/2628-2-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-1-0x0000000000F80000-0x0000000001042000-memory.dmp

Filesize
776KB

Download
memory/2628-3-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download
memory/2860-30-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-25-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-23-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-21-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-19-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-29-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-28-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads