redline | 64378317fa0e4c1ebccaadbee8a32e7b536874e790c9e0a2efb4f6f413f7d554

General

Target

Steam Machine Checker/Steam Machine Checker/Steam Machine Checker.exe
Size

858KB
MD5

669fabfda5514cd557150d678226b0e2
SHA1

60cd496831da31abc1b0867fc9aefa87d1294c36
SHA256

82e9cb3ae011c0b498153d895873dfad35abb9be14d1fa696d92f921b34b3e22
SHA512

09093942e206a71d3ea3b5b5e209903490174a5bfb6f912499399cba487631e53813bbf8656461d6c1f1aa5cef0ff290e1733e4fc8212eeb28230349e05c8a0f
SSDEEP

12288:mHyVa8ngAu2b3BhxN6qjziyoNL4bVwBJ4p31:fgpE3XxNdj4L48Jm

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1948	Google Chrome.exe
2376	SteamMachine[x86].exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Steam Machine Checker.exe

Loads dropped DLL 1 IoCs

pid	Process
2376	SteamMachine[x86].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe
2376	SteamMachine[x86].exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	Google Chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	SteamMachine[x86].exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1948	2044	Steam Machine Checker.exe	83
PID 2044 wrote to memory of 1948	2044	Steam Machine Checker.exe	83
PID 2044 wrote to memory of 1948	2044	Steam Machine Checker.exe	83
PID 2044 wrote to memory of 2376	2044	Steam Machine Checker.exe	85
PID 2044 wrote to memory of 2376	2044	Steam Machine Checker.exe	85
PID 2044 wrote to memory of 2376	2044	Steam Machine Checker.exe	85

C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\Steam Machine Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\Steam Machine Checker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Roaming\Google Chrome.exe
  "C:\Users\Admin\AppData\Roaming\Google Chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\SteamMachine[x86].exe
  "C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\SteamMachine[x86].exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SkinSoft\VisualStyler\2.5.0.0\x86\ssapihook.dll

Filesize
57KB

MD5
9e7f44b8f1512476aa896e977c58830b

SHA1
eddd878d9e16502ee1eb7f583dd04e01b458ba42

SHA256
8e6195b50bb0d22e4d346263f708f166db726c84884fe78a6bb477caed19e708

SHA512
ea52b71dc58e081d0e6c1336e7bf8422d7240c8a502c790075c6ebfe88f8ff70cd2bf43d34b8c604c08d867202359f8bd35c3a0b8d2eefefe826ccd2e5c8c802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\SteamMachine[x86].exe

Filesize
415KB

MD5
067a03373e2853841472022f821793fd

SHA1
f6a0b2baae5c5e61a6ed8903cbb54685497605a9

SHA256
0231117ffb874dcfeaa0740f54a44788d3e49ebdce2f97ab6d8b688b424a0f27

SHA512
0b8f11020546ecf83d8e20cb25b9b22ae34eac6a30a5819d7a454fde0021a018a0e2e47d5e383f75d0b5898ccbde9470031cf81e2a849e84fbbf6320654fc979

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steam Machine Checker\Steam Machine Checker\SteamMachine[x86].exe

Filesize
415KB

MD5
067a03373e2853841472022f821793fd

SHA1
f6a0b2baae5c5e61a6ed8903cbb54685497605a9

SHA256
0231117ffb874dcfeaa0740f54a44788d3e49ebdce2f97ab6d8b688b424a0f27

SHA512
0b8f11020546ecf83d8e20cb25b9b22ae34eac6a30a5819d7a454fde0021a018a0e2e47d5e383f75d0b5898ccbde9470031cf81e2a849e84fbbf6320654fc979

Download Submit
C:\Users\Admin\AppData\Roaming\Google Chrome.exe

Filesize
403KB

MD5
f903148b5a0c07db2c61ce05fa5c7db2

SHA1
b636a8bf5769f7fe27c263eab54026ac03732ad4

SHA256
2999cb6a5b4a9d38c8f85c1b24a6574147c12c90b4a36e5a81c7aa9c7eecfe3d

SHA512
3abb409a61e167f60af116cd2191435bdc7876ce5483905bd944a01dec2c41e5736ae4ffeb628ea74eeef205e7b5e0c0e04520b58e14aa3240bf9a2de0dfd9b9

Download Submit
C:\Users\Admin\AppData\Roaming\Google Chrome.exe

Filesize
403KB

MD5
f903148b5a0c07db2c61ce05fa5c7db2

SHA1
b636a8bf5769f7fe27c263eab54026ac03732ad4

SHA256
2999cb6a5b4a9d38c8f85c1b24a6574147c12c90b4a36e5a81c7aa9c7eecfe3d

SHA512
3abb409a61e167f60af116cd2191435bdc7876ce5483905bd944a01dec2c41e5736ae4ffeb628ea74eeef205e7b5e0c0e04520b58e14aa3240bf9a2de0dfd9b9

Download Submit
memory/1948-146-0x0000000004F90000-0x0000000004FCC000-memory.dmp

Filesize
240KB

Download
memory/1948-152-0x0000000006C40000-0x000000000716C000-memory.dmp

Filesize
5.2MB

Download
memory/1948-139-0x00000000006B0000-0x000000000071A000-memory.dmp

Filesize
424KB

Download
memory/1948-151-0x0000000006540000-0x0000000006702000-memory.dmp

Filesize
1.8MB

Download
memory/1948-143-0x0000000005680000-0x0000000005C98000-memory.dmp

Filesize
6.1MB

Download
memory/1948-144-0x0000000004F30000-0x0000000004F42000-memory.dmp

Filesize
72KB

Download
memory/1948-148-0x0000000005250000-0x000000000535A000-memory.dmp

Filesize
1.0MB

Download
memory/2044-137-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download
memory/2376-142-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download
memory/2376-147-0x00000000057A0000-0x00000000058AE000-memory.dmp

Filesize
1.1MB

Download
memory/2376-145-0x0000000005520000-0x000000000552A000-memory.dmp

Filesize
40KB

Download
memory/2376-141-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/2376-150-0x000000000A2C0000-0x000000000A2E6000-memory.dmp

Filesize
152KB

Download
memory/2376-140-0x0000000000BA0000-0x0000000000C0E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing