redline | ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Size

690KB
MD5

95d6bd9db91e5a888f096857155e04e3
SHA1

5d0628e45f71f1c0f30c5274eb67b97eed94045a
SHA256

ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2
SHA512

ee594767991063e81e4e4f42d80ed7868a67ae1a13d8e433bfb10fc9df87bd8a42115c318caae6f2fc9269165d3f9fc2875d153e15312c0f07f0733bdc63b19b
SSDEEP

12288:fy90rBazQF1SOM2hbDgVuXsIc/JxDnHcW9IN6Lmo:fykUEF1rMsslxDnHR9INJo

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/2040-987-0x00000000075C0000-0x0000000007BD8000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	01530059.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	01530059.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3048	un791441.exe
2084	01530059.exe
2040	rk493197.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	01530059.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un791441.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un791441.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3104	2084	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	01530059.exe
2084	01530059.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	01530059.exe
Token: SeDebugPrivilege	2040	rk493197.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3048	2008	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	84
PID 2008 wrote to memory of 3048	2008	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	84
PID 2008 wrote to memory of 3048	2008	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	84
PID 3048 wrote to memory of 2084	3048	un791441.exe	85
PID 3048 wrote to memory of 2084	3048	un791441.exe	85
PID 3048 wrote to memory of 2084	3048	un791441.exe	85
PID 3048 wrote to memory of 2040	3048	un791441.exe	94
PID 3048 wrote to memory of 2040	3048	un791441.exe	94
PID 3048 wrote to memory of 2040	3048	un791441.exe	94

C:\Users\Admin\AppData\Local\Temp\ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
"C:\Users\Admin\AppData\Local\Temp\ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1084
      4⤵
      Program crash
      PID:3104
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2084 -ip 2084
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
memory/2040-214-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-216-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-996-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-995-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-994-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-993-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-991-0x0000000007D00000-0x0000000007D3C000-memory.dmp

Filesize
240KB

Download
memory/2040-990-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-989-0x0000000007BE0000-0x0000000007CEA000-memory.dmp

Filesize
1.0MB

Download
memory/2040-196-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-987-0x00000000075C0000-0x0000000007BD8000-memory.dmp

Filesize
6.1MB

Download
memory/2040-228-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-194-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-224-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-222-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-220-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-191-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-218-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-210-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-212-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-207-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-209-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-208-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2040-205-0x00000000020C0000-0x0000000002106000-memory.dmp

Filesize
280KB

Download
memory/2040-204-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-192-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-202-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-226-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-988-0x0000000004B60000-0x0000000004B72000-memory.dmp

Filesize
72KB

Download
memory/2040-198-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2040-200-0x0000000004A20000-0x0000000004A55000-memory.dmp

Filesize
212KB

Download
memory/2084-156-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-178-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-150-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2084-186-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2084-184-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2084-182-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2084-183-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2084-181-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2084-148-0x0000000000560000-0x000000000058D000-memory.dmp

Filesize
180KB

Download
memory/2084-168-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-170-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-151-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2084-149-0x0000000004BD0000-0x0000000005174000-memory.dmp

Filesize
5.6MB

Download
memory/2084-172-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-176-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-174-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-164-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-180-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-162-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-160-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-158-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-166-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-154-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-153-0x0000000002470000-0x0000000002483000-memory.dmp

Filesize
76KB

Download
memory/2084-152-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download