redline | 8378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f

General

Target

qZ0RXW.exe
Size

912KB
MD5

8c03063314b0aa3d6a7d26c1f6db60b4
SHA1

6955952347314e7e19895778af232b14a15c736d
SHA256

8378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f
SHA512

d55407a63928afa38612e58fef7253452cc799f8659c4a78e93ba94b2d07feb7a2e47e1294b79879b440fe5bc8ad0d8c7563a6d4e1a0e2d31aa9424c009f9839

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3156-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/3156-12-0x000000000041F39E-mapping.dmp	family_redline
behavioral2/memory/1592-34-0x000000000041F38A-mapping.dmp	family_redline
behavioral2/memory/1592-33-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

1261680494.exe952976788.exe

pid process

744 1261680494.exe
904 952976788.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
744	1261680494.exe
904	952976788.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1261680494.exe952976788.exe

description	pid	process	target process
PID 744 set thread context of 3156	744	1261680494.exe	AddInProcess32.exe
PID 904 set thread context of 1592	904	952976788.exe	AddInProcess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

qZ0RXW.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	qZ0RXW.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	qZ0RXW.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3972 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exeAddInProcess32.exe

pid process

3156 AddInProcess32.exe
1592 AddInProcess32.exe

pid	process
3972	PING.EXE

pid	process
3156	AddInProcess32.exe
1592	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

1261680494.exe952976788.exeAddInProcess32.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	744	1261680494.exe
Token: SeDebugPrivilege	904	952976788.exe
Token: SeDebugPrivilege	3156	AddInProcess32.exe
Token: SeDebugPrivilege	1592	AddInProcess32.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

qZ0RXW.exe1261680494.exe952976788.execmd.exe

description	pid	process	target process
PID 4712 wrote to memory of 744	4712	qZ0RXW.exe	1261680494.exe
PID 4712 wrote to memory of 744	4712	qZ0RXW.exe	1261680494.exe
PID 4712 wrote to memory of 744	4712	qZ0RXW.exe	1261680494.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 744 wrote to memory of 3156	744	1261680494.exe	AddInProcess32.exe
PID 4712 wrote to memory of 904	4712	qZ0RXW.exe	952976788.exe
PID 4712 wrote to memory of 904	4712	qZ0RXW.exe	952976788.exe
PID 4712 wrote to memory of 904	4712	qZ0RXW.exe	952976788.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 904 wrote to memory of 1592	904	952976788.exe	AddInProcess32.exe
PID 4712 wrote to memory of 1872	4712	qZ0RXW.exe	cmd.exe
PID 4712 wrote to memory of 1872	4712	qZ0RXW.exe	cmd.exe
PID 4712 wrote to memory of 1872	4712	qZ0RXW.exe	cmd.exe
PID 1872 wrote to memory of 3972	1872	cmd.exe	PING.EXE
PID 1872 wrote to memory of 3972	1872	cmd.exe	PING.EXE
PID 1872 wrote to memory of 3972	1872	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe
"C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\1261680494.exe
C:\Users\Admin\AppData\Local\Temp\1261680494.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Users\Admin\AppData\Local\Temp\952976788.exe
C:\Users\Admin\AppData\Local\Temp\952976788.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\qZ0RXW.exe & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\PING.EXE
ping 0
3⤵
- Runs ping.exe
PID:3972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
MD5
3375f93b9adc89753e8d23050bce6ca0

SHA1
9532d3600af4bd299e649e8dfd16896ba63fd27e

SHA256
dcea8294dccb23d9690c3f14ebe53b4ed0ee4da80171f238e9cf8160ac708295

SHA512
b4c65c9bb265992311707149cd2e285ae87eaabf179e046d2e38dd22901b84c1aa1ea94966d6f4eed31230f2869ccde47587ec65e92ca58d3a8b1f8358786a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1261680494.exe
MD5
8f42d6ac2ff0bd507f77fc6f2077ecae

SHA1
3f6eb11f4dc112aed5aac9fe3feb78f77e068c93

SHA256
cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f

SHA512
2de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1261680494.exe
MD5
8f42d6ac2ff0bd507f77fc6f2077ecae

SHA1
3f6eb11f4dc112aed5aac9fe3feb78f77e068c93

SHA256
cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f

SHA512
2de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\952976788.exe
MD5
8a71134b5eec8d2bbf849a291b63246d

SHA1
bef03f05daad824da570594d183e233193d07bca

SHA256
36872a3b93b4173cbd71fe1955ae787a62e3e8dfc46a035cf406c06b8bcc66cf

SHA512
408cc8d88afd45e7e0bd52f46560f5ef721dafe703007c140b0fa696615a480e1155726e479ca829023f2d076b7d1401fd99008bbf11c13d3922d1c633218831

Download Submit
C:\Users\Admin\AppData\Local\Temp\952976788.exe
MD5
8a71134b5eec8d2bbf849a291b63246d

SHA1
bef03f05daad824da570594d183e233193d07bca

SHA256
36872a3b93b4173cbd71fe1955ae787a62e3e8dfc46a035cf406c06b8bcc66cf

SHA512
408cc8d88afd45e7e0bd52f46560f5ef721dafe703007c140b0fa696615a480e1155726e479ca829023f2d076b7d1401fd99008bbf11c13d3922d1c633218831

Download Submit
memory/744-5-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6.9MB

Download
memory/744-6-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/744-8-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/744-9-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/744-10-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/744-2-0x0000000000000000-mapping.dmp

Download
memory/904-22-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/904-18-0x0000000000000000-mapping.dmp

Download
memory/904-21-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6.9MB

Download
memory/904-26-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1592-46-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/1592-34-0x000000000041F38A-mapping.dmp

Download
memory/1592-52-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/1592-35-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6.9MB

Download
memory/1592-33-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1872-37-0x0000000000000000-mapping.dmp

Download
memory/3156-28-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/3156-41-0x0000000007070000-0x0000000007071000-memory.dmp

Filesize
4KB

Download
memory/3156-31-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/3156-30-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/3156-29-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/3156-17-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/3156-40-0x0000000006970000-0x0000000006971000-memory.dmp

Filesize
4KB

Download
memory/3156-32-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/3156-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3156-43-0x0000000006B40000-0x0000000006B41000-memory.dmp

Filesize
4KB

Download
memory/3156-44-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

Filesize
4KB

Download
memory/3156-45-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/3156-13-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6.9MB

Download
memory/3156-47-0x0000000007740000-0x0000000007741000-memory.dmp

Filesize
4KB

Download
memory/3156-12-0x000000000041F39E-mapping.dmp

Download
memory/3972-42-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads