redline | 9703a2cf66683041e83bb5a2a23663d85bc41f8e1fb950808707e36d782f182f

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a39ce11c94d7200c8977e41e11977672.exe
Size

695KB
MD5

a39ce11c94d7200c8977e41e11977672
SHA1

8b7ad1b49a3d9fc4f0207bfbab1d6c5372b94838
SHA256

9703a2cf66683041e83bb5a2a23663d85bc41f8e1fb950808707e36d782f182f
SHA512

b136a62ced59758e9554403ceb72948852439c5592a21f1e61a41b2ea1e3364e1ed89211073a382bdbabd7ac150c58f4ae00b4a0dd68fc1ab4de87c3b8e4cb78
SSDEEP

12288:8Mrly90emMQaXJJHkBSaJYeCJ/x9UjGNnwwARxllvvPSQzRHBJoll4RMrOU9HBkT:Jy9Qa5JE9dC1La9fRxTvyIRh2leU96ou

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9225.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9225.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral2/memory/848-188-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-189-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-191-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-193-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-195-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-197-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-199-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-201-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-203-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-205-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-207-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-209-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-211-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-213-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-215-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-217-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-219-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-221-0x0000000004CF0000-0x0000000004D2F000-memory.dmp	family_redline
behavioral2/memory/848-374-0x0000000004D50000-0x0000000004D60000-memory.dmp	family_redline
behavioral2/memory/848-372-0x0000000004D50000-0x0000000004D60000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3036	un167821.exe
1300	pro9225.exe
848	qu3612.exe
1028	si962089.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9225.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a39ce11c94d7200c8977e41e11977672.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a39ce11c94d7200c8977e41e11977672.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un167821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un167821.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1780	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1300	pro9225.exe
1300	pro9225.exe
848	qu3612.exe
848	qu3612.exe
1028	si962089.exe
1028	si962089.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	pro9225.exe
Token: SeDebugPrivilege	848	qu3612.exe
Token: SeDebugPrivilege	1028	si962089.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3036	4272	a39ce11c94d7200c8977e41e11977672.exe	85
PID 4272 wrote to memory of 3036	4272	a39ce11c94d7200c8977e41e11977672.exe	85
PID 4272 wrote to memory of 3036	4272	a39ce11c94d7200c8977e41e11977672.exe	85
PID 3036 wrote to memory of 1300	3036	un167821.exe	86
PID 3036 wrote to memory of 1300	3036	un167821.exe	86
PID 3036 wrote to memory of 1300	3036	un167821.exe	86
PID 3036 wrote to memory of 848	3036	un167821.exe	90
PID 3036 wrote to memory of 848	3036	un167821.exe	90
PID 3036 wrote to memory of 848	3036	un167821.exe	90
PID 4272 wrote to memory of 1028	4272	a39ce11c94d7200c8977e41e11977672.exe	92
PID 4272 wrote to memory of 1028	4272	a39ce11c94d7200c8977e41e11977672.exe	92
PID 4272 wrote to memory of 1028	4272	a39ce11c94d7200c8977e41e11977672.exe	92

C:\Users\Admin\AppData\Local\Temp\a39ce11c94d7200c8977e41e11977672.exe
"C:\Users\Admin\AppData\Local\Temp\a39ce11c94d7200c8977e41e11977672.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un167821.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un167821.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9225.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9225.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962089.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962089.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962089.exe

Filesize
175KB

MD5
1e2a0bc2d3466a2e901902a0274208d3

SHA1
9b7cfb4d7d3e37df2460c3584f9d7d767be3cceb

SHA256
d3e045d3361892e526a849706903f8576cadc4ce83614f0fd9e9e61957ed020d

SHA512
c3f5d727066b77277b290ca754824eea28917132e3b67b09d5e8ae73e2ac4d370979b4891b4ae7d91e95b9a6975e728843b0df3cc15b256978c61dcbc4af4b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962089.exe

Filesize
175KB

MD5
1e2a0bc2d3466a2e901902a0274208d3

SHA1
9b7cfb4d7d3e37df2460c3584f9d7d767be3cceb

SHA256
d3e045d3361892e526a849706903f8576cadc4ce83614f0fd9e9e61957ed020d

SHA512
c3f5d727066b77277b290ca754824eea28917132e3b67b09d5e8ae73e2ac4d370979b4891b4ae7d91e95b9a6975e728843b0df3cc15b256978c61dcbc4af4b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un167821.exe

Filesize
553KB

MD5
bfbcba6e6bef0f6f40a918a34bc86ee4

SHA1
49c5644ba5788c41a8ce037f8ab77d2316e04d94

SHA256
0098f1f3b97f86bb36f4931c4bfd4985d61e2b0800b0cc5d8dc6c89cc2cdbf21

SHA512
fd4ae7035f22b651876478f30f06a57146b8a0d1d118996258750523faf1db7e7e0ae4409a0c484e40437307d1de12484519a0afdbc067d451b5b193de523e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un167821.exe

Filesize
553KB

MD5
bfbcba6e6bef0f6f40a918a34bc86ee4

SHA1
49c5644ba5788c41a8ce037f8ab77d2316e04d94

SHA256
0098f1f3b97f86bb36f4931c4bfd4985d61e2b0800b0cc5d8dc6c89cc2cdbf21

SHA512
fd4ae7035f22b651876478f30f06a57146b8a0d1d118996258750523faf1db7e7e0ae4409a0c484e40437307d1de12484519a0afdbc067d451b5b193de523e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9225.exe

Filesize
308KB

MD5
fa95fd7a15450459e3c4a09e0bd68908

SHA1
fb85a68ac97df7deecb6ddf41ce56e52ca2fae71

SHA256
01ead29424ab6512456c1328556c7b920c0246faf4c3dfcc2f6edfa1d714a080

SHA512
04275092ea42879af0cb3b71292ab88f18e0dc10760356deaec41bba5190acf331b7ca61aaf96608f67b5ed667bb11de3f3f03e0b5a6dc5783ee6d5225aa874f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9225.exe

Filesize
308KB

MD5
fa95fd7a15450459e3c4a09e0bd68908

SHA1
fb85a68ac97df7deecb6ddf41ce56e52ca2fae71

SHA256
01ead29424ab6512456c1328556c7b920c0246faf4c3dfcc2f6edfa1d714a080

SHA512
04275092ea42879af0cb3b71292ab88f18e0dc10760356deaec41bba5190acf331b7ca61aaf96608f67b5ed667bb11de3f3f03e0b5a6dc5783ee6d5225aa874f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3612.exe

Filesize
366KB

MD5
3435a52fd47ecd2d81a2f159c1b847ac

SHA1
1b5c884b59f1c01a63fc9f9a33b632780850ed46

SHA256
6241b10eb8f72ece21be54f0b49d6491b49bec222b85e276f852d4088eb87c66

SHA512
36d1486bac0cda427e0a29412a8e1a9d3640b3f3df1fa429ecff5630ce9073a01d2b572b32d73becaaeffeae4d059e846c0e2e56286fdc5183b230463d2ec53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3612.exe

Filesize
366KB

MD5
3435a52fd47ecd2d81a2f159c1b847ac

SHA1
1b5c884b59f1c01a63fc9f9a33b632780850ed46

SHA256
6241b10eb8f72ece21be54f0b49d6491b49bec222b85e276f852d4088eb87c66

SHA512
36d1486bac0cda427e0a29412a8e1a9d3640b3f3df1fa429ecff5630ce9073a01d2b572b32d73becaaeffeae4d059e846c0e2e56286fdc5183b230463d2ec53a

Download Submit
memory/848-1099-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/848-1102-0x0000000005F50000-0x0000000005FE2000-memory.dmp

Filesize
584KB

Download
memory/848-1112-0x00000000091E0000-0x000000000970C000-memory.dmp

Filesize
5.2MB

Download
memory/848-1111-0x0000000009010000-0x00000000091D2000-memory.dmp

Filesize
1.8MB

Download
memory/848-1110-0x0000000008F80000-0x0000000008FD0000-memory.dmp

Filesize
320KB

Download
memory/848-1109-0x0000000008EE0000-0x0000000008F56000-memory.dmp

Filesize
472KB

Download
memory/848-1108-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-1107-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-1106-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-1105-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-1103-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/848-1101-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/848-1100-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-1098-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/848-1097-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/848-372-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-374-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/848-370-0x0000000000720000-0x000000000076B000-memory.dmp

Filesize
300KB

Download
memory/848-221-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-219-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-188-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-189-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-191-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-193-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-195-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-197-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-199-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-201-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-203-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-205-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-207-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-209-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-211-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-213-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-215-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/848-217-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

Filesize
252KB

Download
memory/1028-1118-0x00000000007E0000-0x0000000000812000-memory.dmp

Filesize
200KB

Download
memory/1028-1120-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/1028-1119-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/1300-171-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-167-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-179-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1300-178-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1300-150-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-177-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-175-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-155-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-173-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-151-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-169-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-180-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1300-165-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-163-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-161-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-159-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-157-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/1300-149-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/1300-148-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/1300-181-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1300-183-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1300-153-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download