redline | a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe
Size

695KB
MD5

bf2ae7f160cdd11203d8176600ef1af4
SHA1

5ff1bcc6521d002446e677cfb819a7a35ec08e14
SHA256

a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513
SHA512

78ab26b37e45145ac8746f37f50571ff458b49fe9bf0d741bf96c311f2fdb4dd5b69a7a2e4da70d8979b644bdc0068911f9b7aac2e61ac366e60c32213efc2c2
SSDEEP

12288:6Mrdy90nwYa5RTKkdw5SfDtpLqMIsuPleFzkPw6M70ZzLvPJ4qpKIVNJjjSm:HySEhfRfxtIseleFzCxpL3FwIPtSm

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0179.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4660-190-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-191-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-193-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-197-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-199-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-195-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-201-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-203-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-205-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-207-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-209-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-211-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-213-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-215-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-217-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-219-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-221-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-223-0x0000000002870000-0x00000000028AF000-memory.dmp	family_redline
behavioral1/memory/4660-247-0x0000000004EF0000-0x0000000004F00000-memory.dmp	family_redline
behavioral1/memory/4660-249-0x0000000004EF0000-0x0000000004F00000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1472	un913180.exe
4900	pro0179.exe
4660	qu2565.exe
3860	si846418.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0179.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un913180.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un913180.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4900	pro0179.exe
4900	pro0179.exe
4660	qu2565.exe
4660	qu2565.exe
3860	si846418.exe
3860	si846418.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	pro0179.exe
Token: SeDebugPrivilege	4660	qu2565.exe
Token: SeDebugPrivilege	3860	si846418.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1472	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	84
PID 1648 wrote to memory of 1472	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	84
PID 1648 wrote to memory of 1472	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	84
PID 1472 wrote to memory of 4900	1472	un913180.exe	85
PID 1472 wrote to memory of 4900	1472	un913180.exe	85
PID 1472 wrote to memory of 4900	1472	un913180.exe	85
PID 1472 wrote to memory of 4660	1472	un913180.exe	89
PID 1472 wrote to memory of 4660	1472	un913180.exe	89
PID 1472 wrote to memory of 4660	1472	un913180.exe	89
PID 1648 wrote to memory of 3860	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	91
PID 1648 wrote to memory of 3860	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	91
PID 1648 wrote to memory of 3860	1648	a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe	91

C:\Users\Admin\AppData\Local\Temp\a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe
"C:\Users\Admin\AppData\Local\Temp\a486d7d406047ae3c4b1ff78ae5a5c7ddc4e5a651e6bfc01a1975f454740e513.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un913180.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un913180.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0179.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0179.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2565.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2565.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846418.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846418.exe

Filesize
175KB

MD5
100901632b1e35509ac644b05dd573e8

SHA1
1cab7f08439bf548984a6d377856a5691693ff85

SHA256
d1a9db0a88e07d4bd5f382ee00b095a78c0c448cf7e0d7a362bbb130f3b627b4

SHA512
f2a51976d7759bdaf62d563b1f13ec91c72a40dc74ca08ffdb82cabad5623325d15e2694e5d2a671e9bafa3bae17cff08f4dd61862d6bc07208b5c498b8fcaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846418.exe

Filesize
175KB

MD5
100901632b1e35509ac644b05dd573e8

SHA1
1cab7f08439bf548984a6d377856a5691693ff85

SHA256
d1a9db0a88e07d4bd5f382ee00b095a78c0c448cf7e0d7a362bbb130f3b627b4

SHA512
f2a51976d7759bdaf62d563b1f13ec91c72a40dc74ca08ffdb82cabad5623325d15e2694e5d2a671e9bafa3bae17cff08f4dd61862d6bc07208b5c498b8fcaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un913180.exe

Filesize
553KB

MD5
d7a89395ad67ad8bc5c54eb243bff4bb

SHA1
98296a6213d4ef97d41be557362d2f918d8078ec

SHA256
2b1da30acbd561e23ddfa33ed747e9b93e06fd0404657ce3eae82db3010a58cd

SHA512
ce4aaea69cfdbdb97a4a1a42bdb03525582e463edf44a0f9d22608e250351e357485c07a1409be57ccc03bf2220fc756c354393a166a9daef9e6b9305e390f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un913180.exe

Filesize
553KB

MD5
d7a89395ad67ad8bc5c54eb243bff4bb

SHA1
98296a6213d4ef97d41be557362d2f918d8078ec

SHA256
2b1da30acbd561e23ddfa33ed747e9b93e06fd0404657ce3eae82db3010a58cd

SHA512
ce4aaea69cfdbdb97a4a1a42bdb03525582e463edf44a0f9d22608e250351e357485c07a1409be57ccc03bf2220fc756c354393a166a9daef9e6b9305e390f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0179.exe

Filesize
308KB

MD5
8ea9df395fb4f97a1df6c6905f8bb3d5

SHA1
3750694f4eb9bb2cab1fe53c9f96bed82fb7e3f5

SHA256
6a90515c2d73968ae0d35a326b0c457880e75f3118a9c933b79ab2f9bc7e8768

SHA512
308df165b538291e3eadf454c979441f293fcd29fdc5a097444cd5dbc88f9abfe0950225841bce15861f37fc93e8239d061086c777e1105234f664fcef3d8702

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0179.exe

Filesize
308KB

MD5
8ea9df395fb4f97a1df6c6905f8bb3d5

SHA1
3750694f4eb9bb2cab1fe53c9f96bed82fb7e3f5

SHA256
6a90515c2d73968ae0d35a326b0c457880e75f3118a9c933b79ab2f9bc7e8768

SHA512
308df165b538291e3eadf454c979441f293fcd29fdc5a097444cd5dbc88f9abfe0950225841bce15861f37fc93e8239d061086c777e1105234f664fcef3d8702

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2565.exe

Filesize
366KB

MD5
251d4ffa8d259d200a2f412a9d9ccdfb

SHA1
559a20b1e74de825436094eabad3f35db2d526ed

SHA256
9c992cdf3e71cf574058d74350ae57d829c5418166e66776d85499f7396a4410

SHA512
7e3ec6d85fdab7e5a0c235a27ef89af16cdfbb297b71c0162c60c43ca74ecf49f416c16d9a08678bacd17bf71fa3f43b48aea40e63059b1859d32b5243b00a93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2565.exe

Filesize
366KB

MD5
251d4ffa8d259d200a2f412a9d9ccdfb

SHA1
559a20b1e74de825436094eabad3f35db2d526ed

SHA256
9c992cdf3e71cf574058d74350ae57d829c5418166e66776d85499f7396a4410

SHA512
7e3ec6d85fdab7e5a0c235a27ef89af16cdfbb297b71c0162c60c43ca74ecf49f416c16d9a08678bacd17bf71fa3f43b48aea40e63059b1859d32b5243b00a93

Download Submit
memory/3860-1120-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/3860-1119-0x0000000000780000-0x00000000007B2000-memory.dmp

Filesize
200KB

Download
memory/4660-1099-0x00000000054B0000-0x0000000005AC8000-memory.dmp

Filesize
6.1MB

Download
memory/4660-1101-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/4660-1113-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-1112-0x00000000069D0000-0x0000000006EFC000-memory.dmp

Filesize
5.2MB

Download
memory/4660-1111-0x0000000006800000-0x00000000069C2000-memory.dmp

Filesize
1.8MB

Download
memory/4660-1110-0x0000000006780000-0x00000000067D0000-memory.dmp

Filesize
320KB

Download
memory/4660-1109-0x00000000066F0000-0x0000000006766000-memory.dmp

Filesize
472KB

Download
memory/4660-1108-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-1107-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-1105-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Filesize
408KB

Download
memory/4660-1104-0x0000000005E10000-0x0000000005EA2000-memory.dmp

Filesize
584KB

Download
memory/4660-1103-0x0000000005B20000-0x0000000005B5C000-memory.dmp

Filesize
240KB

Download
memory/4660-1102-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-1100-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

Filesize
1.0MB

Download
memory/4660-249-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-247-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4660-246-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/4660-223-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-221-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-219-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-190-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-191-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-193-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-197-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-199-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-195-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-201-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-203-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-205-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-207-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-209-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-211-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-213-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-215-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4660-217-0x0000000002870000-0x00000000028AF000-memory.dmp

Filesize
252KB

Download
memory/4900-172-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-150-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4900-185-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4900-183-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4900-182-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4900-181-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4900-152-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4900-180-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-156-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-178-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-148-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/4900-154-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-168-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-170-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-153-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-166-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-164-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-162-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-160-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-158-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-151-0x0000000004C80000-0x0000000005224000-memory.dmp

Filesize
5.6MB

Download
memory/4900-174-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/4900-149-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4900-176-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download