redline | 780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c

General

Target

780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe
Size

689KB
MD5

453d61e006c308f8a86e28fbfd85fb4b
SHA1

9c8649469f8e7bdcad6a153dbb6df60e1c5005e0
SHA256

780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c
SHA512

9d5d2efddf0243c9730f36d6ff636d641c403103feede67332ae40f04ccc89660499ba845263364b957d2ec4a10680bc2022aa48309b79cbb56bc286f43cea4e
SSDEEP

12288:JMrAy90T1kTL3Q/mqsZlwJ3KYm1RNgpQCe6NSLiZYoiO+WQCr1wu:Jyh3Q/1sDwJIRNQQ4SfOfQC5F

Score

10^/10

redline rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pro9190.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9190.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9190.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9190.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9190.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9190.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9190.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/748-191-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-190-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-193-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-198-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-200-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-202-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-206-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-204-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-210-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-208-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-212-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-214-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-216-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-218-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-220-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-222-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-224-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/748-226-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

un573149.exepro9190.exequ7563.exe

pid process

3196 un573149.exe
1116 pro9190.exe
748 qu7563.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3196	un573149.exe
1116	pro9190.exe
748	qu7563.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pro9190.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9190.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9190.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

un573149.exe780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un573149.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un573149.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4252 1116 WerFault.exe pro9190.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

pro9190.exequ7563.exe

pid process

1116 pro9190.exe
1116 pro9190.exe
748 qu7563.exe
748 qu7563.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9190.exequ7563.exe

description pid process

Token: SeDebugPrivilege 1116 pro9190.exe
Token: SeDebugPrivilege 748 qu7563.exe

pid	pid_target	process	target process
4252	1116	WerFault.exe	pro9190.exe

pid	process
1116	pro9190.exe
1116	pro9190.exe
748	qu7563.exe
748	qu7563.exe

description	pid	process
Token: SeDebugPrivilege	1116	pro9190.exe
Token: SeDebugPrivilege	748	qu7563.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exeun573149.exe

description	pid	process	target process
PID 3896 wrote to memory of 3196	3896	780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe	un573149.exe
PID 3896 wrote to memory of 3196	3896	780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe	un573149.exe
PID 3896 wrote to memory of 3196	3896	780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe	un573149.exe
PID 3196 wrote to memory of 1116	3196	un573149.exe	pro9190.exe
PID 3196 wrote to memory of 1116	3196	un573149.exe	pro9190.exe
PID 3196 wrote to memory of 1116	3196	un573149.exe	pro9190.exe
PID 3196 wrote to memory of 748	3196	un573149.exe	qu7563.exe
PID 3196 wrote to memory of 748	3196	un573149.exe	qu7563.exe
PID 3196 wrote to memory of 748	3196	un573149.exe	qu7563.exe

C:\Users\Admin\AppData\Local\Temp\780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe
"C:\Users\Admin\AppData\Local\Temp\780c4d8f2029d51b77c79631fc0ff6c6be434bdc163eb2a2c52f94c19c21083c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3896

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573149.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573149.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3196

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9190.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9190.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 1084
4⤵
- Program crash
PID:4252

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7563.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7563.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1116 -ip 1116
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573149.exe
Filesize
548KB

MD5
83477e7d0444f52342487bffe4f992be

SHA1
bc94f48ddfbf189ca5b36affa3385bdddeb40d23

SHA256
47f83231ec2ad9849f3da4ba7a7c84bc2610dbb3f9c67d4922a1ae52e05f510e

SHA512
0ffcbb0688b4d39e1989b330933b535cbb1eb210fbf6c0a6e72cb92b84ad127b1ab39c7ca1f35f279739a790abbff9d577700469d85f0d6185a52e00073153fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573149.exe
Filesize
548KB

MD5
83477e7d0444f52342487bffe4f992be

SHA1
bc94f48ddfbf189ca5b36affa3385bdddeb40d23

SHA256
47f83231ec2ad9849f3da4ba7a7c84bc2610dbb3f9c67d4922a1ae52e05f510e

SHA512
0ffcbb0688b4d39e1989b330933b535cbb1eb210fbf6c0a6e72cb92b84ad127b1ab39c7ca1f35f279739a790abbff9d577700469d85f0d6185a52e00073153fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9190.exe
Filesize
291KB

MD5
3aceb9d70d398b9ecff3a5511bccd7f6

SHA1
2935c38b67f06bf0af0e03adee2973c2349f7b37

SHA256
081ab265f2dc488af03c5cb2c09aa487843ffa312864f41486634179e618b291

SHA512
d3082c6753957e9b2108215c90d7ccf227191b48bbd072cb6e7774321ad2ecaac8d3ed32f503833b9992e325eaf37a5559fcf87b1d38cf5249a6e644af5982af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9190.exe
Filesize
291KB

MD5
3aceb9d70d398b9ecff3a5511bccd7f6

SHA1
2935c38b67f06bf0af0e03adee2973c2349f7b37

SHA256
081ab265f2dc488af03c5cb2c09aa487843ffa312864f41486634179e618b291

SHA512
d3082c6753957e9b2108215c90d7ccf227191b48bbd072cb6e7774321ad2ecaac8d3ed32f503833b9992e325eaf37a5559fcf87b1d38cf5249a6e644af5982af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7563.exe
Filesize
350KB

MD5
e61708d0f7174d9a472c7d782046ff2b

SHA1
d677fc8d50eae86a45542fd0263c86375a213262

SHA256
0fd3d5c0bb104ca8b0b33a0c8c58143c78300f046bb30cf0cbd5af89c437bb0c

SHA512
2afc0c64ba81d2d235a728e7c07bf047d1e647b27898681e9840bfab3b33f5b107aead27c8b39686dec6c4cbffa68f2e8478fb6b16daea57489e68ec48c79170

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7563.exe
Filesize
350KB

MD5
e61708d0f7174d9a472c7d782046ff2b

SHA1
d677fc8d50eae86a45542fd0263c86375a213262

SHA256
0fd3d5c0bb104ca8b0b33a0c8c58143c78300f046bb30cf0cbd5af89c437bb0c

SHA512
2afc0c64ba81d2d235a728e7c07bf047d1e647b27898681e9840bfab3b33f5b107aead27c8b39686dec6c4cbffa68f2e8478fb6b16daea57489e68ec48c79170

Download Submit
memory/748-222-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-226-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-1114-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1113-0x0000000006EA0000-0x0000000006EF0000-memory.dmp

Filesize
320KB

Download
memory/748-197-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-193-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-1111-0x00000000067B0000-0x0000000006CDC000-memory.dmp

Filesize
5.2MB

Download
memory/748-1110-0x00000000065D0000-0x0000000006792000-memory.dmp

Filesize
1.8MB

Download
memory/748-1109-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1108-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1107-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1105-0x00000000064E0000-0x0000000006572000-memory.dmp

Filesize
584KB

Download
memory/748-1104-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/748-1103-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1102-0x0000000005C20000-0x0000000005C5C000-memory.dmp

Filesize
240KB

Download
memory/748-1101-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/748-1100-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

Filesize
1.0MB

Download
memory/748-1099-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Filesize
6.1MB

Download
memory/748-224-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-220-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-218-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-216-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-214-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-212-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-191-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-190-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-194-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/748-195-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/748-1112-0x0000000006E00000-0x0000000006E76000-memory.dmp

Filesize
472KB

Download
memory/748-208-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-198-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-200-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-202-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-206-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-204-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/748-210-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1116-185-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1116-157-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-150-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1116-175-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-183-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1116-182-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1116-173-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-181-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1116-151-0x0000000002430000-0x0000000002440000-memory.dmp

Filesize
64KB

Download
memory/1116-180-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1116-152-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-177-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-171-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-148-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/1116-155-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-169-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-167-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-165-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-163-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-161-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-159-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-149-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/1116-153-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1116-179-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads