redline | ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe
Size

556KB
MD5

8ecde932aebcfdfd4a09f343893d3eac
SHA1

56c429f6d5138f54623772977088394de294d309
SHA256

ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d
SHA512

91bf22b2b82597ef28dbb270f362fae7bee6e99d0983d198206784f2b68339fbab838b53878346b765887b99b3d4c0912e783be90306b84e4ffd82286ecb4860
SSDEEP

12288:UMrNy90M/VTKyLWdY1LEI9CYfMN7gGp450tR7K:pyL/BpLWe1gh79vRe

Score

10^/10

redline boris lenka discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

lenka

193.233.20.32:4125

Attributes

auth_value
8a60e8b2ec79d6a7e92f9feac39b8830

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0278.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0278.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0278.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0278.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0278.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0278.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 32 IoCs

resource	yara_rule
behavioral1/memory/3864-155-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-157-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-161-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-163-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-165-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-167-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-169-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-171-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-173-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-175-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-177-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-179-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-181-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-183-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-185-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-187-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-189-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-191-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-193-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-195-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-197-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-199-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-201-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-203-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-205-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-207-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-209-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-211-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-213-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-215-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-217-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/3864-219-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1576	unio2060.exe
3188	pro0278.exe
3864	qu6307.exe
5024	si717265.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0278.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	unio2060.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	unio2060.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	3864	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3188	pro0278.exe
3188	pro0278.exe
3864	qu6307.exe
3864	qu6307.exe
5024	si717265.exe
5024	si717265.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	pro0278.exe
Token: SeDebugPrivilege	3864	qu6307.exe
Token: SeDebugPrivilege	5024	si717265.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1576	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	85
PID 2996 wrote to memory of 1576	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	85
PID 2996 wrote to memory of 1576	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	85
PID 1576 wrote to memory of 3188	1576	unio2060.exe	86
PID 1576 wrote to memory of 3188	1576	unio2060.exe	86
PID 1576 wrote to memory of 3864	1576	unio2060.exe	87
PID 1576 wrote to memory of 3864	1576	unio2060.exe	87
PID 1576 wrote to memory of 3864	1576	unio2060.exe	87
PID 2996 wrote to memory of 5024	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	91
PID 2996 wrote to memory of 5024	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	91
PID 2996 wrote to memory of 5024	2996	ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe	91

C:\Users\Admin\AppData\Local\Temp\ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe
"C:\Users\Admin\AppData\Local\Temp\ca0f50f9705dd2af6ba109882535a00361394f6e29d9b8e4c84d59298b15f60d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2060.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2060.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0278.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0278.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6307.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 1648
      4⤵
      Program crash
      PID:3296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si717265.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si717265.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3864 -ip 3864
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si717265.exe

Filesize
175KB

MD5
851136bbcaf6dd8e4a90d4436f1343e4

SHA1
0281dbf9ef3c7b0a6d311f8115e858e9ef6c4b79

SHA256
94152896056eae1b548f5950fc1652b6659dca0e7140f209cad9a319c0a6dc37

SHA512
b2fec1c60906350c70cbd44b80972b7fce1fb8e4e09b744b82ad0ab6db729464fe8e8f98452dd036290b9bd76417e4199c34ee20bded17418841192cc422c768

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si717265.exe

Filesize
175KB

MD5
851136bbcaf6dd8e4a90d4436f1343e4

SHA1
0281dbf9ef3c7b0a6d311f8115e858e9ef6c4b79

SHA256
94152896056eae1b548f5950fc1652b6659dca0e7140f209cad9a319c0a6dc37

SHA512
b2fec1c60906350c70cbd44b80972b7fce1fb8e4e09b744b82ad0ab6db729464fe8e8f98452dd036290b9bd76417e4199c34ee20bded17418841192cc422c768

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2060.exe

Filesize
414KB

MD5
f95c6f0ee77aaa4e7e064ddee4a3e88d

SHA1
3e54144bc0f2f6f58c7c47b2ce8e47ff1b022f03

SHA256
8beed84a44828e2e929c2f0c06ce5589c38cd108f754001133e53f0d0c8a636f

SHA512
ebc4f47a10b18340d6ec0926f3dfab56cda20f661ab26acbd70c986cd0aa6c9b4d9fa1d3d98b837dee738a10e42fc588c9f3e6e431378a1a4eaf0a47ad582912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2060.exe

Filesize
414KB

MD5
f95c6f0ee77aaa4e7e064ddee4a3e88d

SHA1
3e54144bc0f2f6f58c7c47b2ce8e47ff1b022f03

SHA256
8beed84a44828e2e929c2f0c06ce5589c38cd108f754001133e53f0d0c8a636f

SHA512
ebc4f47a10b18340d6ec0926f3dfab56cda20f661ab26acbd70c986cd0aa6c9b4d9fa1d3d98b837dee738a10e42fc588c9f3e6e431378a1a4eaf0a47ad582912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0278.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0278.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6307.exe

Filesize
387KB

MD5
b0a9d633af2db5219d25167974db9436

SHA1
eca3148daeb33d75053e9a3948d0c1190e9e33b7

SHA256
eb98496952bbd266fc38c5ae0c296aa5e259410910200f4091be9998c4e3c8ae

SHA512
42b3161446c77baaaf873eb19beb90a1d266517c45da101af0fc8c3a2518f35516b08a6cd0932c6bad13d47e73daad63e530b5806e8507370e3157c00edfa819

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6307.exe

Filesize
387KB

MD5
b0a9d633af2db5219d25167974db9436

SHA1
eca3148daeb33d75053e9a3948d0c1190e9e33b7

SHA256
eb98496952bbd266fc38c5ae0c296aa5e259410910200f4091be9998c4e3c8ae

SHA512
42b3161446c77baaaf873eb19beb90a1d266517c45da101af0fc8c3a2518f35516b08a6cd0932c6bad13d47e73daad63e530b5806e8507370e3157c00edfa819

Download Submit
memory/3188-147-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download
memory/3188-149-0x000000001ACB0000-0x000000001ADFE000-memory.dmp

Filesize
1.3MB

Download
memory/3864-154-0x0000000007150000-0x00000000076F4000-memory.dmp

Filesize
5.6MB

Download
memory/3864-158-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-156-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/3864-155-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-159-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-157-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-161-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-163-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-165-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-167-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-169-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-171-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-173-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-175-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-177-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-179-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-181-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-183-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-185-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-187-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-189-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-191-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-193-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-195-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-197-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-199-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-201-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-203-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-205-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-207-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-209-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-211-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-213-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-215-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-217-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-219-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/3864-1064-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/3864-1065-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/3864-1066-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/3864-1067-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-1068-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/3864-1070-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/3864-1071-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/3864-1072-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-1073-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-1074-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/3864-1075-0x0000000008DC0000-0x0000000008F82000-memory.dmp

Filesize
1.8MB

Download
memory/3864-1076-0x0000000008FA0000-0x00000000094CC000-memory.dmp

Filesize
5.2MB

Download
memory/3864-1077-0x0000000009610000-0x0000000009686000-memory.dmp

Filesize
472KB

Download
memory/3864-1078-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/3864-1079-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/5024-1085-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download
memory/5024-1086-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download