redline | 5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787

Analysis

max time kernel
56s
max time network
70s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2023 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe
Size

690KB
MD5

6c953827155fd83e4c12c45108dece89
SHA1

439df51613c4302e6737b1388736bfc5d921cd2e
SHA256

5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787
SHA512

697df41349753bbfd9a6acf24267dcde8fcb42409d3547c1b93b1df85ff938f87685f307fed872451823e93d360bfe20eb82c30ff6dea35776a5a996d4e86be9
SSDEEP

12288:CMrQy90eXJdaJ6Xj7MyuXxc6E1yQ65hLuGCDuMSKE3V7bqqBjX3bTtvyFnxfigri:GyRnhj7McjcvfaGwuLt3V7bqqBr3bpOS

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3715.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1088-179-0x0000000003910000-0x0000000003956000-memory.dmp	family_redline
behavioral1/memory/1088-182-0x0000000006570000-0x00000000065B4000-memory.dmp	family_redline
behavioral1/memory/1088-185-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-186-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-188-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-190-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-192-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-194-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-196-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-198-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-200-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-202-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-204-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-206-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-208-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-210-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-212-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-214-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-216-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline
behavioral1/memory/1088-218-0x0000000006570000-0x00000000065AF000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
4956	un564007.exe
4284	pro3715.exe
1088	qu6482.exe
4776	si524470.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3715.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un564007.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un564007.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4284	pro3715.exe
4284	pro3715.exe
1088	qu6482.exe
1088	qu6482.exe
4776	si524470.exe
4776	si524470.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	pro3715.exe
Token: SeDebugPrivilege	1088	qu6482.exe
Token: SeDebugPrivilege	4776	si524470.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4956	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	66
PID 1736 wrote to memory of 4956	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	66
PID 1736 wrote to memory of 4956	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	66
PID 4956 wrote to memory of 4284	4956	un564007.exe	67
PID 4956 wrote to memory of 4284	4956	un564007.exe	67
PID 4956 wrote to memory of 4284	4956	un564007.exe	67
PID 4956 wrote to memory of 1088	4956	un564007.exe	68
PID 4956 wrote to memory of 1088	4956	un564007.exe	68
PID 4956 wrote to memory of 1088	4956	un564007.exe	68
PID 1736 wrote to memory of 4776	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	70
PID 1736 wrote to memory of 4776	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	70
PID 1736 wrote to memory of 4776	1736	5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe	70

C:\Users\Admin\AppData\Local\Temp\5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe
"C:\Users\Admin\AppData\Local\Temp\5c681661389826ef5492ac389ae21575ceed35ec2bbe1f0a45ee56c87845d787.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564007.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564007.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6482.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si524470.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si524470.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si524470.exe

Filesize
175KB

MD5
71fef5a863606779a64bf85ec1fb313e

SHA1
0dd3b335ca07688d6737bbf4fefa77610c400324

SHA256
3c05e3c402aee51cf29f50707096f053adef9128cb1fa8d36a369c750addc6c3

SHA512
e219e276fdcd9923fe346e5383198ab0dd494041ca849b0c8adbe3b8f71634c03310d01d0303557968066f55196d17942d8324583541d108dba4b2373ac680a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si524470.exe

Filesize
175KB

MD5
71fef5a863606779a64bf85ec1fb313e

SHA1
0dd3b335ca07688d6737bbf4fefa77610c400324

SHA256
3c05e3c402aee51cf29f50707096f053adef9128cb1fa8d36a369c750addc6c3

SHA512
e219e276fdcd9923fe346e5383198ab0dd494041ca849b0c8adbe3b8f71634c03310d01d0303557968066f55196d17942d8324583541d108dba4b2373ac680a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564007.exe

Filesize
548KB

MD5
672ba5c9324bf0a59e367edf3f0b0a0a

SHA1
521b476d8c6a204eebf40bc885996060780b8a77

SHA256
7118c1e44c9a8ecacafd3120869713c87a62b0b4d8f3c6aa9fef2873204826e2

SHA512
d9c55c1d89fcb9779cf8aabca62fd64d40df460b004900462f56a02be55a7f693efb7273e64d2a322e8a51fd13389a3b1a925057ad407de88628834f0033b335

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564007.exe

Filesize
548KB

MD5
672ba5c9324bf0a59e367edf3f0b0a0a

SHA1
521b476d8c6a204eebf40bc885996060780b8a77

SHA256
7118c1e44c9a8ecacafd3120869713c87a62b0b4d8f3c6aa9fef2873204826e2

SHA512
d9c55c1d89fcb9779cf8aabca62fd64d40df460b004900462f56a02be55a7f693efb7273e64d2a322e8a51fd13389a3b1a925057ad407de88628834f0033b335

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe

Filesize
291KB

MD5
a225e25f9bbc4eebc6e5eddd9680fe07

SHA1
48cefcc6355011e89bfb67956e9dd9c6f6328633

SHA256
e1cb9180d53d86c2310ff60c6230908cacbd15ceee972e82886a082911034074

SHA512
0fc76baa8adf679d28159cf1494ff206da816ad761f5a95b6504788f2062c4a6387feb7f92eac8eee959fb53f932576b97c9f9d38b37485e5281ced20163fc53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe

Filesize
291KB

MD5
a225e25f9bbc4eebc6e5eddd9680fe07

SHA1
48cefcc6355011e89bfb67956e9dd9c6f6328633

SHA256
e1cb9180d53d86c2310ff60c6230908cacbd15ceee972e82886a082911034074

SHA512
0fc76baa8adf679d28159cf1494ff206da816ad761f5a95b6504788f2062c4a6387feb7f92eac8eee959fb53f932576b97c9f9d38b37485e5281ced20163fc53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6482.exe

Filesize
345KB

MD5
a13342013c215d55c5cc4dffe4063340

SHA1
82ea39525db9bdaaaec60dd58fe45304f9e348b4

SHA256
9cea595b54da1d8fa0bd3697f3b9cca2a23529af262e25e88fc672f097b0191f

SHA512
64eda6452b93475a44960c0fe0674f54bf40f44214a8daa4b0d3909e8b78200a401793b34a359dfd800fd8d80484b3a1c9e52098c56fd4b4b2a0c792649ab9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6482.exe

Filesize
345KB

MD5
a13342013c215d55c5cc4dffe4063340

SHA1
82ea39525db9bdaaaec60dd58fe45304f9e348b4

SHA256
9cea595b54da1d8fa0bd3697f3b9cca2a23529af262e25e88fc672f097b0191f

SHA512
64eda6452b93475a44960c0fe0674f54bf40f44214a8daa4b0d3909e8b78200a401793b34a359dfd800fd8d80484b3a1c9e52098c56fd4b4b2a0c792649ab9d9

Download Submit
memory/1088-1093-0x0000000006D10000-0x0000000006D22000-memory.dmp

Filesize
72KB

Download
memory/1088-1094-0x0000000006D30000-0x0000000006D6E000-memory.dmp

Filesize
248KB

Download
memory/1088-1107-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-1106-0x0000000008E30000-0x000000000935C000-memory.dmp

Filesize
5.2MB

Download
memory/1088-1105-0x0000000008C60000-0x0000000008E22000-memory.dmp

Filesize
1.8MB

Download
memory/1088-1104-0x0000000007920000-0x0000000007970000-memory.dmp

Filesize
320KB

Download
memory/1088-1103-0x0000000007890000-0x0000000007906000-memory.dmp

Filesize
472KB

Download
memory/1088-1102-0x00000000076D0000-0x0000000007762000-memory.dmp

Filesize
584KB

Download
memory/1088-1100-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-1101-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-1099-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-1098-0x0000000007010000-0x0000000007076000-memory.dmp

Filesize
408KB

Download
memory/1088-1096-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-192-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-1095-0x0000000006E80000-0x0000000006ECB000-memory.dmp

Filesize
300KB

Download
memory/1088-1092-0x0000000006C00000-0x0000000006D0A000-memory.dmp

Filesize
1.0MB

Download
memory/1088-1091-0x00000000065B0000-0x0000000006BB6000-memory.dmp

Filesize
6.0MB

Download
memory/1088-218-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-216-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-214-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-212-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-210-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-208-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-179-0x0000000003910000-0x0000000003956000-memory.dmp

Filesize
280KB

Download
memory/1088-194-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-182-0x0000000006570000-0x00000000065B4000-memory.dmp

Filesize
272KB

Download
memory/1088-184-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-183-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-181-0x0000000006060000-0x0000000006070000-memory.dmp

Filesize
64KB

Download
memory/1088-185-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-186-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-188-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-206-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-190-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-180-0x0000000001B00000-0x0000000001B4B000-memory.dmp

Filesize
300KB

Download
memory/1088-196-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-198-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-200-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-202-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/1088-204-0x0000000006570000-0x00000000065AF000-memory.dmp

Filesize
252KB

Download
memory/4284-174-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4284-148-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-140-0x0000000002630000-0x0000000002648000-memory.dmp

Filesize
96KB

Download
memory/4284-158-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-173-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4284-171-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4284-170-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4284-169-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4284-168-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-138-0x0000000002470000-0x000000000248A000-memory.dmp

Filesize
104KB

Download
memory/4284-156-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-166-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-162-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-139-0x0000000004E10000-0x000000000530E000-memory.dmp

Filesize
5.0MB

Download
memory/4284-150-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-141-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-154-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-152-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-164-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-160-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-146-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-144-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-142-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4284-137-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/4284-136-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/4776-1113-0x0000000000990000-0x00000000009C2000-memory.dmp

Filesize
200KB

Download
memory/4776-1114-0x00000000052A0000-0x00000000052EB000-memory.dmp

Filesize
300KB

Download
memory/4776-1115-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download