redline | 9ad0e30aa9644a1156e04b683dbf5b3c3459e62b3178a36e900352c0428181b3

Analysis

max time kernel
109s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

103ea6eab3c8319c68efe3357bcc5325.exe
Size

666KB
MD5

103ea6eab3c8319c68efe3357bcc5325
SHA1

1efcc6693842eeafc6512a8e54c55258eebfd1cd
SHA256

9ad0e30aa9644a1156e04b683dbf5b3c3459e62b3178a36e900352c0428181b3
SHA512

47067d9bb7cfe04039dd9dc68ee655aa16ceff10d6ec7295529ea0d55109c0df221eb951119ef643a02b9e5e16aa964bcf8d8296c2ecd846af5054f3583d0cd3
SSDEEP

12288:6Mrny90Xqb9ZIEE477gUm8ZaErJcL9he+ArU8Ry/w5xvcr5gt1:ByWqb9dJ8Um8IE9cZg+ArTMw5xEmt1

Score

10^/10

redline rosn spora discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

176.113.115.145:4125

Attributes

auth_value
441b39ab37774b2ca9931c31e1bc6071

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3291.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral2/memory/1736-190-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-191-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-193-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-195-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-197-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-199-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-201-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-203-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-205-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-207-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-209-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-211-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-213-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-215-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-217-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-219-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-221-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral2/memory/1736-223-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1052	un299443.exe
3224	pro3291.exe
1736	qu9487.exe
1404	si585112.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3291.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3291.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	103ea6eab3c8319c68efe3357bcc5325.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	103ea6eab3c8319c68efe3357bcc5325.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un299443.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un299443.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2148	3224	WerFault.exe	86
2788	1736	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3224	pro3291.exe
3224	pro3291.exe
1736	qu9487.exe
1736	qu9487.exe
1404	si585112.exe
1404	si585112.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	pro3291.exe
Token: SeDebugPrivilege	1736	qu9487.exe
Token: SeDebugPrivilege	1404	si585112.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 1052	3204	103ea6eab3c8319c68efe3357bcc5325.exe	85
PID 3204 wrote to memory of 1052	3204	103ea6eab3c8319c68efe3357bcc5325.exe	85
PID 3204 wrote to memory of 1052	3204	103ea6eab3c8319c68efe3357bcc5325.exe	85
PID 1052 wrote to memory of 3224	1052	un299443.exe	86
PID 1052 wrote to memory of 3224	1052	un299443.exe	86
PID 1052 wrote to memory of 3224	1052	un299443.exe	86
PID 1052 wrote to memory of 1736	1052	un299443.exe	96
PID 1052 wrote to memory of 1736	1052	un299443.exe	96
PID 1052 wrote to memory of 1736	1052	un299443.exe	96
PID 3204 wrote to memory of 1404	3204	103ea6eab3c8319c68efe3357bcc5325.exe	100
PID 3204 wrote to memory of 1404	3204	103ea6eab3c8319c68efe3357bcc5325.exe	100
PID 3204 wrote to memory of 1404	3204	103ea6eab3c8319c68efe3357bcc5325.exe	100

C:\Users\Admin\AppData\Local\Temp\103ea6eab3c8319c68efe3357bcc5325.exe
"C:\Users\Admin\AppData\Local\Temp\103ea6eab3c8319c68efe3357bcc5325.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299443.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299443.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3291.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3291.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1084
      4⤵
      Program crash
      PID:2148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9487.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1348
      4⤵
      Program crash
      PID:2788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si585112.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si585112.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3224 -ip 3224
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1736 -ip 1736
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si585112.exe

Filesize
176KB

MD5
bf7ff324e2c405065bfb283ef9c141c5

SHA1
a982b6b3a80c842e77f446e307b6bfcd56d70fb6

SHA256
017341e12b2635419a78f7337c60de75a3181e53473fa7538f122c906b231d0b

SHA512
94e97860cf92fbceee04b767c8443a02da16b280fa4bb61121279bd4e540903517bb9ad3ecce9eaf544a3d2aa766eee1b66060d1428a8134a1fa29471e57e983

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si585112.exe

Filesize
176KB

MD5
bf7ff324e2c405065bfb283ef9c141c5

SHA1
a982b6b3a80c842e77f446e307b6bfcd56d70fb6

SHA256
017341e12b2635419a78f7337c60de75a3181e53473fa7538f122c906b231d0b

SHA512
94e97860cf92fbceee04b767c8443a02da16b280fa4bb61121279bd4e540903517bb9ad3ecce9eaf544a3d2aa766eee1b66060d1428a8134a1fa29471e57e983

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299443.exe

Filesize
524KB

MD5
4949aa06d69e20e55aa35f2912326b1d

SHA1
caedb333ccac00d96c8df74f6ae44bf6f8b086df

SHA256
4fb82c820096c41cd3340042b6725839cdece387419646e14e751fcbec737534

SHA512
70b96e9b28d490465aca77b8b93c689a82abaaf7025cf95f8fe3c50b4c135bcb2ebf0343a616b4a39d2c3ca59ffe1841e983556ba7ac62c5a6537584d24964a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299443.exe

Filesize
524KB

MD5
4949aa06d69e20e55aa35f2912326b1d

SHA1
caedb333ccac00d96c8df74f6ae44bf6f8b086df

SHA256
4fb82c820096c41cd3340042b6725839cdece387419646e14e751fcbec737534

SHA512
70b96e9b28d490465aca77b8b93c689a82abaaf7025cf95f8fe3c50b4c135bcb2ebf0343a616b4a39d2c3ca59ffe1841e983556ba7ac62c5a6537584d24964a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3291.exe

Filesize
294KB

MD5
66547802da6b11e357e7e2a1bb48d304

SHA1
782407a5f57b00bf67f510e8695d25031985e396

SHA256
f89177d4fec365309f0eb293ee7372ba3dc35dc67a735619de2737ddc22e4687

SHA512
351130a2dc3bf70d7ed5bde9633e8565d777b50cf96e85a922f7fe6a5247de2479b3c496677661354da42404be23fa74ffe9c562733aa9aaf29110e56d8746ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3291.exe

Filesize
294KB

MD5
66547802da6b11e357e7e2a1bb48d304

SHA1
782407a5f57b00bf67f510e8695d25031985e396

SHA256
f89177d4fec365309f0eb293ee7372ba3dc35dc67a735619de2737ddc22e4687

SHA512
351130a2dc3bf70d7ed5bde9633e8565d777b50cf96e85a922f7fe6a5247de2479b3c496677661354da42404be23fa74ffe9c562733aa9aaf29110e56d8746ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9487.exe

Filesize
352KB

MD5
bdc6aac7b75bf992adeb439c731b305a

SHA1
7164242630013fafc7bcc2196acbb9f83ea32374

SHA256
136a124efa2d93c7e24a69c56f6ef051d9dabdfe88fb31b30ac9975b96dfadd2

SHA512
03aad9e634ef39d4490162f3b9fd560850471459af0892f084f4eaea343f8aafd3a764410dd24a4acc6659340af3664cb618cd6eed83a737c994b5a544d8ed82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9487.exe

Filesize
352KB

MD5
bdc6aac7b75bf992adeb439c731b305a

SHA1
7164242630013fafc7bcc2196acbb9f83ea32374

SHA256
136a124efa2d93c7e24a69c56f6ef051d9dabdfe88fb31b30ac9975b96dfadd2

SHA512
03aad9e634ef39d4490162f3b9fd560850471459af0892f084f4eaea343f8aafd3a764410dd24a4acc6659340af3664cb618cd6eed83a737c994b5a544d8ed82

Download Submit
memory/1404-1121-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1404-1120-0x0000000000390000-0x00000000003C2000-memory.dmp

Filesize
200KB

Download
memory/1736-361-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-1101-0x0000000005B40000-0x0000000005C4A000-memory.dmp

Filesize
1.0MB

Download
memory/1736-1114-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-1113-0x0000000007090000-0x00000000070E0000-memory.dmp

Filesize
320KB

Download
memory/1736-1112-0x0000000007000000-0x0000000007076000-memory.dmp

Filesize
472KB

Download
memory/1736-1111-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-1110-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-1109-0x00000000068A0000-0x0000000006DCC000-memory.dmp

Filesize
5.2MB

Download
memory/1736-1107-0x00000000066D0000-0x0000000006892000-memory.dmp

Filesize
1.8MB

Download
memory/1736-1106-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/1736-1105-0x0000000005F00000-0x0000000005F92000-memory.dmp

Filesize
584KB

Download
memory/1736-1104-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-1103-0x0000000004F20000-0x0000000004F5C000-memory.dmp

Filesize
240KB

Download
memory/1736-1102-0x0000000004F00000-0x0000000004F12000-memory.dmp

Filesize
72KB

Download
memory/1736-1100-0x0000000005520000-0x0000000005B38000-memory.dmp

Filesize
6.1MB

Download
memory/1736-358-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-354-0x00000000023A0000-0x00000000023EB000-memory.dmp

Filesize
300KB

Download
memory/1736-356-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1736-223-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-221-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-190-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-191-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-193-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-195-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-197-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-199-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-201-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-203-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-205-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-207-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-209-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-211-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-213-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-215-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-217-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/1736-219-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/3224-173-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-181-0x0000000000AE0000-0x0000000000B0D000-memory.dmp

Filesize
180KB

Download
memory/3224-185-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3224-183-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/3224-182-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/3224-153-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-175-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-159-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-180-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3224-179-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-157-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-177-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-163-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-171-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-169-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-167-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-155-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-164-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/3224-166-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/3224-161-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-151-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-150-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/3224-149-0x0000000004E30000-0x00000000053D4000-memory.dmp

Filesize
5.6MB

Download
memory/3224-148-0x0000000000AE0000-0x0000000000B0D000-memory.dmp

Filesize
180KB

Download