redline | 856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93

Analysis

max time kernel
71s
max time network
143s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe
Size

685KB
MD5

18fa5994fe0a4e1b5ecadf4339035bcd
SHA1

30092438ffb30146d244f6ad8d95c9e1319664f8
SHA256

856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93
SHA512

4e666583b32c3a310a4efe02ba882cb3e9f638ee6452b572ba2e71154ad737132b5d3fe37b6ad1d9dfeb62976e352ab2f07bdf4866be9887327ec2f7b337bd95
SSDEEP

12288:/Mrwy90T/w5bEl1X5RJSkPKyz0GmfqwwvvwUBKYiEnVBZ8UN:DyM/JVRrKy7mfqLXYYiEvZBN

Score

10^/10

redline nice sony discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

193.233.20.33:4125

Attributes

auth_value
a7371b75699e8bc7c51fb960e8ac9e81

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3990.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3990.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3990.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3990.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3990.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/2052-178-0x0000000002290000-0x00000000022D6000-memory.dmp	family_redline
behavioral1/memory/2052-179-0x00000000051D0000-0x0000000005214000-memory.dmp	family_redline
behavioral1/memory/2052-180-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-181-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-183-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-185-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-187-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-189-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-191-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-193-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-195-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-197-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-199-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-201-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-208-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-204-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-210-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-212-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-214-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline
behavioral1/memory/2052-216-0x00000000051D0000-0x000000000520E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
4180	un377617.exe
3916	pro3990.exe
2052	qu3742.exe
4364	si601983.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3990.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3990.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un377617.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un377617.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3916	pro3990.exe
3916	pro3990.exe
2052	qu3742.exe
2052	qu3742.exe
4364	si601983.exe
4364	si601983.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	pro3990.exe
Token: SeDebugPrivilege	2052	qu3742.exe
Token: SeDebugPrivilege	4364	si601983.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4180	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	66
PID 3640 wrote to memory of 4180	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	66
PID 3640 wrote to memory of 4180	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	66
PID 4180 wrote to memory of 3916	4180	un377617.exe	67
PID 4180 wrote to memory of 3916	4180	un377617.exe	67
PID 4180 wrote to memory of 3916	4180	un377617.exe	67
PID 4180 wrote to memory of 2052	4180	un377617.exe	68
PID 4180 wrote to memory of 2052	4180	un377617.exe	68
PID 4180 wrote to memory of 2052	4180	un377617.exe	68
PID 3640 wrote to memory of 4364	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	70
PID 3640 wrote to memory of 4364	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	70
PID 3640 wrote to memory of 4364	3640	856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe	70

C:\Users\Admin\AppData\Local\Temp\856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe
"C:\Users\Admin\AppData\Local\Temp\856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377617.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377617.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3990.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3990.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3742.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601983.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601983.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601983.exe

Filesize
175KB

MD5
33c5f6bde5c4d4e5858a1cb1cdc1acb0

SHA1
c42ec4e2a50509a701a03909b0c8ab9598681f2b

SHA256
f0ff773dcc12eaeb98e902d235fbcf19d79e0ef82d3735fa763d130e076b2b51

SHA512
73f3054084795b28259db4e9188690c41677a1e6c5cea7676182e5ecea70c712b8bfa454154a08a35f596329765347a392b0fd222ebda8fc6d8ffaea229cde7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si601983.exe

Filesize
175KB

MD5
33c5f6bde5c4d4e5858a1cb1cdc1acb0

SHA1
c42ec4e2a50509a701a03909b0c8ab9598681f2b

SHA256
f0ff773dcc12eaeb98e902d235fbcf19d79e0ef82d3735fa763d130e076b2b51

SHA512
73f3054084795b28259db4e9188690c41677a1e6c5cea7676182e5ecea70c712b8bfa454154a08a35f596329765347a392b0fd222ebda8fc6d8ffaea229cde7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377617.exe

Filesize
543KB

MD5
74abde217ee41cd2d5fcaf45077a1393

SHA1
3ffe9a660bc1f0da66e7e57426d222041c65867b

SHA256
9aabec782378d100e34a24357b8589fd94ef21629d623780bc22fcc046023e9e

SHA512
b4d7586d75bf75b76114e4421e3e403c97a171b362adb4d24a6d18877379861c8c60fea50f2bd9ec2318fe1de29e2d45f608bc0c4c640844aa1052f0a5d88b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377617.exe

Filesize
543KB

MD5
74abde217ee41cd2d5fcaf45077a1393

SHA1
3ffe9a660bc1f0da66e7e57426d222041c65867b

SHA256
9aabec782378d100e34a24357b8589fd94ef21629d623780bc22fcc046023e9e

SHA512
b4d7586d75bf75b76114e4421e3e403c97a171b362adb4d24a6d18877379861c8c60fea50f2bd9ec2318fe1de29e2d45f608bc0c4c640844aa1052f0a5d88b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3990.exe

Filesize
292KB

MD5
20e9652e47b2cbb64e87953d6c03c943

SHA1
c4d4e8eb05152932ed50c2f7338609bcab61b3f2

SHA256
fd06cad2551968f58c060292ac16e11373727ed82ff6ead5079207e80fbca1d0

SHA512
d0548df90fca251d304afe52ba835e74648ca7070e7dee9e610910f63a55f4428c7b8b5c7262b45ae32642dfee64ec71ded31c7cb1e21ebb01c194e211b15eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3990.exe

Filesize
292KB

MD5
20e9652e47b2cbb64e87953d6c03c943

SHA1
c4d4e8eb05152932ed50c2f7338609bcab61b3f2

SHA256
fd06cad2551968f58c060292ac16e11373727ed82ff6ead5079207e80fbca1d0

SHA512
d0548df90fca251d304afe52ba835e74648ca7070e7dee9e610910f63a55f4428c7b8b5c7262b45ae32642dfee64ec71ded31c7cb1e21ebb01c194e211b15eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3742.exe

Filesize
350KB

MD5
dccd45a8ef6d57ab657f8ab2d86a06b1

SHA1
2c3f7af875f3716cff348f3c0204fd219f3a10e5

SHA256
11f91c7b26911bda11c70e53db97d10452920fbbdb94e9dde4c18ebe444d1863

SHA512
9974513ac5d5cc4994b6c588483aeee8748d2e1570d8124200498d0087aaffc7c6872519267bb8136498b7cdc539044638a94f797fbfe83f1239b8386c8209e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3742.exe

Filesize
350KB

MD5
dccd45a8ef6d57ab657f8ab2d86a06b1

SHA1
2c3f7af875f3716cff348f3c0204fd219f3a10e5

SHA256
11f91c7b26911bda11c70e53db97d10452920fbbdb94e9dde4c18ebe444d1863

SHA512
9974513ac5d5cc4994b6c588483aeee8748d2e1570d8124200498d0087aaffc7c6872519267bb8136498b7cdc539044638a94f797fbfe83f1239b8386c8209e8

Download Submit
memory/2052-216-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-1089-0x0000000005980000-0x0000000005F86000-memory.dmp

Filesize
6.0MB

Download
memory/2052-1104-0x0000000006AF0000-0x000000000701C000-memory.dmp

Filesize
5.2MB

Download
memory/2052-1103-0x0000000006920000-0x0000000006AE2000-memory.dmp

Filesize
1.8MB

Download
memory/2052-1102-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-1101-0x00000000068B0000-0x0000000006900000-memory.dmp

Filesize
320KB

Download
memory/2052-1100-0x0000000006830000-0x00000000068A6000-memory.dmp

Filesize
472KB

Download
memory/2052-191-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-1099-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-1098-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-1096-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/2052-1095-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/2052-1094-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-193-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-1093-0x00000000056A0000-0x00000000056EB000-memory.dmp

Filesize
300KB

Download
memory/2052-1092-0x0000000005550000-0x000000000558E000-memory.dmp

Filesize
248KB

Download
memory/2052-1091-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/2052-195-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-1090-0x00000000053F0000-0x00000000054FA000-memory.dmp

Filesize
1.0MB

Download
memory/2052-203-0x0000000000720000-0x000000000076B000-memory.dmp

Filesize
300KB

Download
memory/2052-214-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-212-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-210-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-204-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-178-0x0000000002290000-0x00000000022D6000-memory.dmp

Filesize
280KB

Download
memory/2052-179-0x00000000051D0000-0x0000000005214000-memory.dmp

Filesize
272KB

Download
memory/2052-180-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-181-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-183-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-185-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-187-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-189-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-208-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-207-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-205-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2052-197-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-199-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/2052-201-0x00000000051D0000-0x000000000520E000-memory.dmp

Filesize
248KB

Download
memory/3916-166-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-168-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-160-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-148-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-137-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/3916-139-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3916-173-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/3916-171-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3916-136-0x0000000004C30000-0x0000000004C48000-memory.dmp

Filesize
96KB

Download
memory/3916-170-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3916-169-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/3916-140-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3916-164-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-162-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-158-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-156-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-154-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-152-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-150-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-146-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-144-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-142-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-141-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/3916-138-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3916-135-0x0000000004D80000-0x000000000527E000-memory.dmp

Filesize
5.0MB

Download
memory/3916-134-0x00000000025A0000-0x00000000025BA000-memory.dmp

Filesize
104KB

Download
memory/4364-1110-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/4364-1111-0x0000000005720000-0x000000000576B000-memory.dmp

Filesize
300KB

Download
memory/4364-1112-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download