redline | 3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe
Size

695KB
MD5

06f925f61bf5e76f84d8c64fb92563a9
SHA1

4f6dc144d28156d09c50cf05966039ce5c15b309
SHA256

3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491
SHA512

a3e5a5341f7ebeba025f624c8fde70e97ece8076181299fefa1b1115a8cba78e19d391cb26e9c51ba0692cedc9fa467864309f9e0858a04ecb999fcdbd057fcd
SSDEEP

12288:PMrBy90GSGzdXsfyaqpMifkFDtnfEluPl/K7Oe9VzNDMJNNK7Ksy8FRg5z:ay5JctqpVyxMlel/yOyVN49CLyWu9

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro5619.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/4240-191-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-192-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-194-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-196-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-198-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-200-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-202-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-204-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-206-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-208-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-210-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-212-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-214-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-216-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-218-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-220-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-222-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline
behavioral1/memory/4240-224-0x00000000028D0000-0x000000000290F000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
5060	un222985.exe
636	pro5619.exe
4240	qu6378.exe
4940	si688498.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro5619.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro5619.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un222985.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un222985.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
636	pro5619.exe
636	pro5619.exe
4240	qu6378.exe
4240	qu6378.exe
4940	si688498.exe
4940	si688498.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	pro5619.exe
Token: SeDebugPrivilege	4240	qu6378.exe
Token: SeDebugPrivilege	4940	si688498.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 5060	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	84
PID 4088 wrote to memory of 5060	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	84
PID 4088 wrote to memory of 5060	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	84
PID 5060 wrote to memory of 636	5060	un222985.exe	85
PID 5060 wrote to memory of 636	5060	un222985.exe	85
PID 5060 wrote to memory of 636	5060	un222985.exe	85
PID 5060 wrote to memory of 4240	5060	un222985.exe	92
PID 5060 wrote to memory of 4240	5060	un222985.exe	92
PID 5060 wrote to memory of 4240	5060	un222985.exe	92
PID 4088 wrote to memory of 4940	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	94
PID 4088 wrote to memory of 4940	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	94
PID 4088 wrote to memory of 4940	4088	3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe	94

C:\Users\Admin\AppData\Local\Temp\3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe
"C:\Users\Admin\AppData\Local\Temp\3e2485f1a6f956cb7dc1e325c91e1eeaeaa08b631a38127b2db1cf43b63c2491.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222985.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222985.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5619.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5619.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6378.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688498.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688498.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688498.exe

Filesize
175KB

MD5
99c0f2bc8e5f13f8bf1dd079473bdb91

SHA1
2d6a1c72ba591e3d1f43b48226907f230fc639c3

SHA256
f6d1b9c92a0bc9b285f9674419066f4cbde69dde2ed14352eadb462c78880145

SHA512
2bcb43d718e1810c8d1555b49941b91d5d8f206354fc50b823169d5432ceeb113bcf1e6551f757b83ec282c2c3ffd27af85ca432478c25f7dfec748b0dd62abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si688498.exe

Filesize
175KB

MD5
99c0f2bc8e5f13f8bf1dd079473bdb91

SHA1
2d6a1c72ba591e3d1f43b48226907f230fc639c3

SHA256
f6d1b9c92a0bc9b285f9674419066f4cbde69dde2ed14352eadb462c78880145

SHA512
2bcb43d718e1810c8d1555b49941b91d5d8f206354fc50b823169d5432ceeb113bcf1e6551f757b83ec282c2c3ffd27af85ca432478c25f7dfec748b0dd62abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222985.exe

Filesize
553KB

MD5
de415c4a84d3a7298a1ac81691dcd903

SHA1
c6e0ad049482a41f25fc9205f7b13397005d8704

SHA256
561af79db77ae04db9c15dd50768bf0f3cae63dbf1d15d9382c98c7fc35b31ea

SHA512
fb4194c841aa2337ac6d362ef3514c1efd4a771644133205a59aba7cd8a66127a5093ed60b29a9013a8a49276713244e5d6c852e39adebf5b1337bf8e52f58c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un222985.exe

Filesize
553KB

MD5
de415c4a84d3a7298a1ac81691dcd903

SHA1
c6e0ad049482a41f25fc9205f7b13397005d8704

SHA256
561af79db77ae04db9c15dd50768bf0f3cae63dbf1d15d9382c98c7fc35b31ea

SHA512
fb4194c841aa2337ac6d362ef3514c1efd4a771644133205a59aba7cd8a66127a5093ed60b29a9013a8a49276713244e5d6c852e39adebf5b1337bf8e52f58c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5619.exe

Filesize
308KB

MD5
54359c68350bd560c11a8182609e45cb

SHA1
84f65ef6346db4d5901eaeab4d4bcd7bacf98145

SHA256
3694b7bf93d6ea253a7c39c3dc8038891a6b737e87fccfb9ac5f178866c3ed08

SHA512
7d94ff9b6377ffc52f68bf8e18a945b59db171e81aa390cd37ebc08e6f9a3addc2a3cff3a0628a736f50cde23cc20352f881dc19bbe5e0d54cf4c1b81f393ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5619.exe

Filesize
308KB

MD5
54359c68350bd560c11a8182609e45cb

SHA1
84f65ef6346db4d5901eaeab4d4bcd7bacf98145

SHA256
3694b7bf93d6ea253a7c39c3dc8038891a6b737e87fccfb9ac5f178866c3ed08

SHA512
7d94ff9b6377ffc52f68bf8e18a945b59db171e81aa390cd37ebc08e6f9a3addc2a3cff3a0628a736f50cde23cc20352f881dc19bbe5e0d54cf4c1b81f393ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6378.exe

Filesize
366KB

MD5
94df116c502f1e8f5185c21bdb8c1b0f

SHA1
5231ffbc36763830efaaf4991fe56c382581330a

SHA256
eb77b8c8e2b3d3b4a9713b084f5014fdb500a9fddd0325e4252cbb35a95e8084

SHA512
d76b30552ccc09c3d827b08156f4f4c2e65e2e964eeeb13aba08bf5be811a2db91367bbd6d0962ada1e027849f9483bf41e735ae809e2f9780902c8acf873603

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6378.exe

Filesize
366KB

MD5
94df116c502f1e8f5185c21bdb8c1b0f

SHA1
5231ffbc36763830efaaf4991fe56c382581330a

SHA256
eb77b8c8e2b3d3b4a9713b084f5014fdb500a9fddd0325e4252cbb35a95e8084

SHA512
d76b30552ccc09c3d827b08156f4f4c2e65e2e964eeeb13aba08bf5be811a2db91367bbd6d0962ada1e027849f9483bf41e735ae809e2f9780902c8acf873603

Download Submit
memory/636-148-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/636-149-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/636-150-0x0000000004E30000-0x00000000053D4000-memory.dmp

Filesize
5.6MB

Download
memory/636-151-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-152-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-154-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-156-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-158-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-160-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-162-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-164-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-166-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-168-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-170-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-172-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-174-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-176-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-178-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/636-179-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/636-180-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/636-182-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4240-187-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/4240-188-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-189-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-190-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-191-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-192-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-194-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-196-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-198-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-200-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-202-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-204-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-206-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-208-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-210-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-212-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-214-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-216-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-218-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-220-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-222-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-224-0x00000000028D0000-0x000000000290F000-memory.dmp

Filesize
252KB

Download
memory/4240-1097-0x0000000005480000-0x0000000005A98000-memory.dmp

Filesize
6.1MB

Download
memory/4240-1098-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/4240-1099-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/4240-1100-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/4240-1101-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-1102-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/4240-1103-0x0000000006620000-0x00000000066B2000-memory.dmp

Filesize
584KB

Download
memory/4240-1105-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-1106-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-1107-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4240-1108-0x0000000006710000-0x0000000006786000-memory.dmp

Filesize
472KB

Download
memory/4240-1109-0x00000000067A0000-0x00000000067F0000-memory.dmp

Filesize
320KB

Download
memory/4240-1110-0x0000000006800000-0x00000000069C2000-memory.dmp

Filesize
1.8MB

Download
memory/4240-1111-0x00000000069D0000-0x0000000006EFC000-memory.dmp

Filesize
5.2MB

Download
memory/4240-1112-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/4940-1118-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/4940-1119-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download