redline | 7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe
Size

690KB
MD5

134d98e30f279b63eb5e6b0e3e182028
SHA1

d2475cff17f3610bf623ebaca1ef1beeba9290b7
SHA256

7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de
SHA512

07cc0633eab70c7b182ce6ae438fa11392a38c67184bf0ca76aeb5d881dee89378d0f1429e625c7e5afa6d67578318756dd956769386747d2d41389212ae4bae
SSDEEP

12288:VMr+y90CKY7PsFmatnLOOyd65hLuK5K4wp80iLOcvxFHmfigyIJD1z:DykY7PoCLwfaKp44zTHmagBd

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2578.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2578.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/460-193-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-194-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-196-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-198-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-200-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-202-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-204-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-206-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-208-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-210-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-212-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-214-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-216-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-218-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-220-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-222-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-224-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline
behavioral1/memory/460-226-0x0000000006600000-0x000000000663F000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2724	un440260.exe
3984	pro2578.exe
460	qu5188.exe
1212	si054014.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2578.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un440260.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un440260.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4144	3984	WerFault.exe	83
1996	460	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3984	pro2578.exe
3984	pro2578.exe
460	qu5188.exe
460	qu5188.exe
1212	si054014.exe
1212	si054014.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	pro2578.exe
Token: SeDebugPrivilege	460	qu5188.exe
Token: SeDebugPrivilege	1212	si054014.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2724	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	82
PID 3776 wrote to memory of 2724	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	82
PID 3776 wrote to memory of 2724	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	82
PID 2724 wrote to memory of 3984	2724	un440260.exe	83
PID 2724 wrote to memory of 3984	2724	un440260.exe	83
PID 2724 wrote to memory of 3984	2724	un440260.exe	83
PID 2724 wrote to memory of 460	2724	un440260.exe	89
PID 2724 wrote to memory of 460	2724	un440260.exe	89
PID 2724 wrote to memory of 460	2724	un440260.exe	89
PID 3776 wrote to memory of 1212	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	93
PID 3776 wrote to memory of 1212	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	93
PID 3776 wrote to memory of 1212	3776	7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe	93

C:\Users\Admin\AppData\Local\Temp\7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe
"C:\Users\Admin\AppData\Local\Temp\7075b881ae6f53ced4ef6677fca5bf50c2b530dc778608780de8c8e6065fb3de.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un440260.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un440260.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2578.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2578.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1080
      4⤵
      Program crash
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5188.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 1348
      4⤵
      Program crash
      PID:1996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054014.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054014.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3984 -ip 3984
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 460 -ip 460
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054014.exe

Filesize
175KB

MD5
f71d793d38ca31b0d746db29709c038a

SHA1
f0c903b9c7626fd490f772c27c0f905c49e5cdc0

SHA256
2644cc1146374af28b444ee23fd55bcb60de9fff9a74a97739f893632f988c43

SHA512
7589982faf268dcc32850bb676754f6e4c2c585a542133a9d131a37c49dfad77769d9c9c239f41b70444e9b70763d78d13ba58c117d911d929f660f2d9524a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si054014.exe

Filesize
175KB

MD5
f71d793d38ca31b0d746db29709c038a

SHA1
f0c903b9c7626fd490f772c27c0f905c49e5cdc0

SHA256
2644cc1146374af28b444ee23fd55bcb60de9fff9a74a97739f893632f988c43

SHA512
7589982faf268dcc32850bb676754f6e4c2c585a542133a9d131a37c49dfad77769d9c9c239f41b70444e9b70763d78d13ba58c117d911d929f660f2d9524a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un440260.exe

Filesize
548KB

MD5
8eb7cea35e9520579824646ae197a947

SHA1
b9223137b431cc5c5020824f9bfcb74934dd701a

SHA256
975970cd88c1e496e4650bf89b4f14bf3febc078ccbc80dfde5085c526ed468d

SHA512
eeb7c9619c9abf73d2434fdf9107e41774fdd36d710a3a90364c7c04a5f52628638b12dc9a0552e5d7268485947fa17b4ffef23cf3daac99b41a6bda4b79ee37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un440260.exe

Filesize
548KB

MD5
8eb7cea35e9520579824646ae197a947

SHA1
b9223137b431cc5c5020824f9bfcb74934dd701a

SHA256
975970cd88c1e496e4650bf89b4f14bf3febc078ccbc80dfde5085c526ed468d

SHA512
eeb7c9619c9abf73d2434fdf9107e41774fdd36d710a3a90364c7c04a5f52628638b12dc9a0552e5d7268485947fa17b4ffef23cf3daac99b41a6bda4b79ee37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2578.exe

Filesize
291KB

MD5
31b757e39b8cffad584e995ddece43f7

SHA1
b5e745a42e4a0ef6f9a426f51f0213eefcffb474

SHA256
e3b3ecdf906ea82ade11e6f888e680af24e75705c260e73106428b580fee7282

SHA512
1ee195aea28a583ee879becea54e4aa0732f6d18793c34dfe9726cf7f4c6567d65d1126967af0d0bc72e3837f2fbf62acba3678f67b655e6179aad2747bb10ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2578.exe

Filesize
291KB

MD5
31b757e39b8cffad584e995ddece43f7

SHA1
b5e745a42e4a0ef6f9a426f51f0213eefcffb474

SHA256
e3b3ecdf906ea82ade11e6f888e680af24e75705c260e73106428b580fee7282

SHA512
1ee195aea28a583ee879becea54e4aa0732f6d18793c34dfe9726cf7f4c6567d65d1126967af0d0bc72e3837f2fbf62acba3678f67b655e6179aad2747bb10ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5188.exe

Filesize
345KB

MD5
c3b79a9394fbce1868cc46769ed71096

SHA1
7b4f5b9ef293b8f0ae0f769e067d209d289ae8f0

SHA256
7f06026c7f888efefab4a2015b302dc87d66fb7e1bac3651004c16a439507835

SHA512
06be09399f49a525a6f7734d28d5778b444cdf4ee55d33086acf1f13622316ff954cd6c785836e27d6b5e88b293cb3b97077945ff915d27a98240702a56af926

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5188.exe

Filesize
345KB

MD5
c3b79a9394fbce1868cc46769ed71096

SHA1
7b4f5b9ef293b8f0ae0f769e067d209d289ae8f0

SHA256
7f06026c7f888efefab4a2015b302dc87d66fb7e1bac3651004c16a439507835

SHA512
06be09399f49a525a6f7734d28d5778b444cdf4ee55d33086acf1f13622316ff954cd6c785836e27d6b5e88b293cb3b97077945ff915d27a98240702a56af926

Download Submit
memory/460-1099-0x0000000006640000-0x0000000006C58000-memory.dmp

Filesize
6.1MB

Download
memory/460-1102-0x0000000006E30000-0x0000000006E6C000-memory.dmp

Filesize
240KB

Download
memory/460-1113-0x0000000007F50000-0x000000000847C000-memory.dmp

Filesize
5.2MB

Download
memory/460-1112-0x0000000007D80000-0x0000000007F42000-memory.dmp

Filesize
1.8MB

Download
memory/460-1111-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-1110-0x0000000007AB0000-0x0000000007B00000-memory.dmp

Filesize
320KB

Download
memory/460-1109-0x0000000007A30000-0x0000000007AA6000-memory.dmp

Filesize
472KB

Download
memory/460-1108-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-1107-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-1105-0x00000000071C0000-0x0000000007226000-memory.dmp

Filesize
408KB

Download
memory/460-1104-0x0000000007120000-0x00000000071B2000-memory.dmp

Filesize
584KB

Download
memory/460-1103-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-1101-0x0000000006E10000-0x0000000006E22000-memory.dmp

Filesize
72KB

Download
memory/460-1100-0x0000000006CD0000-0x0000000006DDA000-memory.dmp

Filesize
1.0MB

Download
memory/460-226-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-224-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-222-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-220-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-218-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-216-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-214-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-189-0x0000000001AD0000-0x0000000001B1B000-memory.dmp

Filesize
300KB

Download
memory/460-190-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-191-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-192-0x0000000003B80000-0x0000000003B90000-memory.dmp

Filesize
64KB

Download
memory/460-193-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-194-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-196-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-198-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-200-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-202-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-204-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-206-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-208-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-210-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/460-212-0x0000000006600000-0x000000000663F000-memory.dmp

Filesize
252KB

Download
memory/1212-1119-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download
memory/1212-1121-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1212-1120-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/3984-171-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-167-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-180-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/3984-179-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-149-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/3984-177-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-175-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-153-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-173-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-151-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/3984-169-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-181-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/3984-165-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-163-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-161-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-159-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-157-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-155-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/3984-150-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/3984-148-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/3984-182-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/3984-184-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/3984-152-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download