redline | 8378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f

General

Target

qZ0RXW.exe
Size

912KB
MD5

8c03063314b0aa3d6a7d26c1f6db60b4
SHA1

6955952347314e7e19895778af232b14a15c736d
SHA256

8378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f
SHA512

d55407a63928afa38612e58fef7253452cc799f8659c4a78e93ba94b2d07feb7a2e47e1294b79879b440fe5bc8ad0d8c7563a6d4e1a0e2d31aa9424c009f9839

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2532-12-0x000000000041F39E-mapping.dmp	family_redline
behavioral2/memory/2532-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/3764-27-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/3764-28-0x000000000041F38A-mapping.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

1027109889.exe1561157813.exe

pid process

3264 1027109889.exe
2832 1561157813.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
3264	1027109889.exe
2832	1561157813.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1027109889.exe1561157813.exe

description	pid	process	target process
PID 3264 set thread context of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 2832 set thread context of 3764	2832	1561157813.exe	AddInProcess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

qZ0RXW.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	qZ0RXW.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	qZ0RXW.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1356 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exeAddInProcess32.exe

pid process

2532 AddInProcess32.exe
3764 AddInProcess32.exe

pid	process
1356	PING.EXE

pid	process
2532	AddInProcess32.exe
3764	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

1027109889.exe1561157813.exeAddInProcess32.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	3264	1027109889.exe
Token: SeDebugPrivilege	2832	1561157813.exe
Token: SeDebugPrivilege	2532	AddInProcess32.exe
Token: SeDebugPrivilege	3764	AddInProcess32.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

qZ0RXW.exe1027109889.exe1561157813.execmd.exe

description	pid	process	target process
PID 1276 wrote to memory of 3264	1276	qZ0RXW.exe	1027109889.exe
PID 1276 wrote to memory of 3264	1276	qZ0RXW.exe	1027109889.exe
PID 1276 wrote to memory of 3264	1276	qZ0RXW.exe	1027109889.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 3264 wrote to memory of 2532	3264	1027109889.exe	AddInProcess32.exe
PID 1276 wrote to memory of 2832	1276	qZ0RXW.exe	1561157813.exe
PID 1276 wrote to memory of 2832	1276	qZ0RXW.exe	1561157813.exe
PID 1276 wrote to memory of 2832	1276	qZ0RXW.exe	1561157813.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 2832 wrote to memory of 3764	2832	1561157813.exe	AddInProcess32.exe
PID 1276 wrote to memory of 2812	1276	qZ0RXW.exe	cmd.exe
PID 1276 wrote to memory of 2812	1276	qZ0RXW.exe	cmd.exe
PID 1276 wrote to memory of 2812	1276	qZ0RXW.exe	cmd.exe
PID 2812 wrote to memory of 1356	2812	cmd.exe	PING.EXE
PID 2812 wrote to memory of 1356	2812	cmd.exe	PING.EXE
PID 2812 wrote to memory of 1356	2812	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe
"C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\1027109889.exe
C:\Users\Admin\AppData\Local\Temp\1027109889.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Users\Admin\AppData\Local\Temp\1561157813.exe
C:\Users\Admin\AppData\Local\Temp\1561157813.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\PING.EXE
ping 0
3⤵
- Runs ping.exe
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
MD5
3375f93b9adc89753e8d23050bce6ca0

SHA1
9532d3600af4bd299e649e8dfd16896ba63fd27e

SHA256
dcea8294dccb23d9690c3f14ebe53b4ed0ee4da80171f238e9cf8160ac708295

SHA512
b4c65c9bb265992311707149cd2e285ae87eaabf179e046d2e38dd22901b84c1aa1ea94966d6f4eed31230f2869ccde47587ec65e92ca58d3a8b1f8358786a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1027109889.exe
MD5
8f42d6ac2ff0bd507f77fc6f2077ecae

SHA1
3f6eb11f4dc112aed5aac9fe3feb78f77e068c93

SHA256
cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f

SHA512
2de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1027109889.exe
MD5
8f42d6ac2ff0bd507f77fc6f2077ecae

SHA1
3f6eb11f4dc112aed5aac9fe3feb78f77e068c93

SHA256
cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f

SHA512
2de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1561157813.exe
MD5
8a71134b5eec8d2bbf849a291b63246d

SHA1
bef03f05daad824da570594d183e233193d07bca

SHA256
36872a3b93b4173cbd71fe1955ae787a62e3e8dfc46a035cf406c06b8bcc66cf

SHA512
408cc8d88afd45e7e0bd52f46560f5ef721dafe703007c140b0fa696615a480e1155726e479ca829023f2d076b7d1401fd99008bbf11c13d3922d1c633218831

Download Submit
C:\Users\Admin\AppData\Local\Temp\1561157813.exe
MD5
8a71134b5eec8d2bbf849a291b63246d

SHA1
bef03f05daad824da570594d183e233193d07bca

SHA256
36872a3b93b4173cbd71fe1955ae787a62e3e8dfc46a035cf406c06b8bcc66cf

SHA512
408cc8d88afd45e7e0bd52f46560f5ef721dafe703007c140b0fa696615a480e1155726e479ca829023f2d076b7d1401fd99008bbf11c13d3922d1c633218831

Download Submit
memory/1356-34-0x0000000000000000-mapping.dmp

Download
memory/2532-40-0x0000000005E80000-0x0000000005E81000-memory.dmp

Filesize
4KB

Download
memory/2532-37-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/2532-12-0x000000000041F39E-mapping.dmp

Download
memory/2532-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2532-13-0x0000000072E00000-0x00000000734EE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-58-0x0000000007C30000-0x0000000007C31000-memory.dmp

Filesize
4KB

Download
memory/2532-52-0x0000000007140000-0x0000000007141000-memory.dmp

Filesize
4KB

Download
memory/2532-51-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/2532-50-0x0000000007030000-0x0000000007031000-memory.dmp

Filesize
4KB

Download
memory/2532-49-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/2532-25-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/2532-48-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/2532-41-0x00000000060E0000-0x00000000060E1000-memory.dmp

Filesize
4KB

Download
memory/2532-39-0x0000000005E40000-0x0000000005E41000-memory.dmp

Filesize
4KB

Download
memory/2532-38-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/2812-33-0x0000000000000000-mapping.dmp

Download
memory/2832-17-0x0000000000000000-mapping.dmp

Download
memory/2832-26-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/2832-21-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/2832-20-0x0000000072E00000-0x00000000734EE000-memory.dmp

Filesize
6.9MB

Download
memory/3264-8-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/3264-5-0x0000000072E00000-0x00000000734EE000-memory.dmp

Filesize
6.9MB

Download
memory/3264-10-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/3264-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3264-2-0x0000000000000000-mapping.dmp

Download
memory/3264-9-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/3764-29-0x0000000072E00000-0x00000000734EE000-memory.dmp

Filesize
6.9MB

Download
memory/3764-27-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3764-28-0x000000000041F38A-mapping.dmp

Download
memory/3764-35-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads