redline | bf7c6277b852bf3a8e286ce02377757875768f6d32f5df127f2931b86c5dcf2c

Analysis

max time kernel
150s
max time network
106s
platform
windows7_x64
resource
win7v20201028
submitted
05/03/2021, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Smash Installer for Windows/1.exe
Size 877KB
Sample210305-kal2t1vmv2
SHA256 1fd155e7fc507bd4df5d7c8ee6f5bf97cff1c38c8d2980d5ab6724065f22e2dc
MD5 d86660dabe13d725cc14711d45d88182
SHA1 0be41dddc0d60f9d005ad9bad661c02d60f79836
SHA512 d014cb4dee7f58b12e9bc8d88c36bb0255832395da8b7365e529f9ae80ec0fd1658826d76a94b27a000aaa04820aa713f5022dbebfeddd007eb30b02cb043fa5
MD5 SHA1 SHA512

Score

10^/10

redline discovery infostealer spyware

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1784	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
908	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1380	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp

Loads dropped DLL 1 IoCs

pid	Process
1932	1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0ad9ac3d811d701	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0ad1ec5d811d701	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1380	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
1380	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	1.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
Token: SeDebugPrivilege	1380	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
Token: SeManageVolumePrivilege	316	SearchIndexer.exe
Token: 33	316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	316	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1148	SearchProtocolHost.exe
1148	SearchProtocolHost.exe
1148	SearchProtocolHost.exe
1148	SearchProtocolHost.exe
1148	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1084	SearchProtocolHost.exe
1148	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1540	1932	1.exe	33
PID 1932 wrote to memory of 1540	1932	1.exe	33
PID 1932 wrote to memory of 1540	1932	1.exe	33
PID 1932 wrote to memory of 1540	1932	1.exe	33
PID 1540 wrote to memory of 1784	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	34
PID 1540 wrote to memory of 1784	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	34
PID 1540 wrote to memory of 1784	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	34
PID 1540 wrote to memory of 1784	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	34
PID 1540 wrote to memory of 908	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	35
PID 1540 wrote to memory of 908	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	35
PID 1540 wrote to memory of 908	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	35
PID 1540 wrote to memory of 908	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	35
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 1540 wrote to memory of 1380	1540	wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp	36
PID 316 wrote to memory of 1148	316	SearchIndexer.exe	40
PID 316 wrote to memory of 1148	316	SearchIndexer.exe	40
PID 316 wrote to memory of 1148	316	SearchIndexer.exe	40
PID 316 wrote to memory of 1780	316	SearchIndexer.exe	41
PID 316 wrote to memory of 1780	316	SearchIndexer.exe	41
PID 316 wrote to memory of 1780	316	SearchIndexer.exe	41
PID 316 wrote to memory of 1084	316	SearchIndexer.exe	42
PID 316 wrote to memory of 1084	316	SearchIndexer.exe	42
PID 316 wrote to memory of 1084	316	SearchIndexer.exe	42

C:\Users\Admin\AppData\Local\Temp\Smash Installer for Windows\1.exe
"C:\Users\Admin\AppData\Local\Temp\Smash Installer for Windows\1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1932
- C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
  C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
    "{path}"
    3⤵
    - Executes dropped EXE
    PID:1784
- - C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
    "{path}"
    3⤵
    - Executes dropped EXE
    PID:908
- - C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp
    "{path}"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1380

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3825035466-2522850611-591511364-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3825035466-2522850611-591511364-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1148
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
  2⤵
  PID:1780
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-24-0x000007FEF6E90000-0x000007FEF710A000-memory.dmp

Download

memory/692-4-0x000007FEF6E90000-0x000007FEF710A000-memory.dmp

Download

memory/1380-20-0x0000000073870000-0x0000000073F5E000-memory.dmp

Download

memory/1380-23-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/1380-21-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1380-17-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1540-14-0x0000000004A90000-0x0000000004AD7000-memory.dmp

Download

memory/1540-12-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/1540-13-0x0000000001D10000-0x0000000001D1B000-memory.dmp

Download

memory/1540-10-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/1540-9-0x0000000073870000-0x0000000073F5E000-memory.dmp

Download

memory/1748-3-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Download

memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Download