redline | a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
Size

691KB
MD5

d0fb48d898d81a8d109e7825feb7b195
SHA1

1b3cffddb8d82d480bf925661110086cb064981c
SHA256

a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81
SHA512

2fa3ea744e860421f1c45170662350955ff6b583e4ff521a60acd27cf2956aa5e88c6ec283b15779b6190e162f38fb5d1990616e292159bbd6662ff17e0cfeea
SSDEEP

12288:Ey90j+HH/HoZeeEaDkfRkOSz3HoEGOniNBmvxsEsXNBK:Eyq+n/Ig+GRzSeNMF6NBK

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4760-987-0x0000000007510000-0x0000000007B28000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	02756733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	02756733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	02756733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	02756733.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	02756733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	02756733.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4336	un792698.exe
1732	02756733.exe
4760	rk929973.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	02756733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	02756733.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un792698.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un792698.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5104	1732	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	02756733.exe
1732	02756733.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	02756733.exe
Token: SeDebugPrivilege	4760	rk929973.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4336	4388	a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe	83
PID 4388 wrote to memory of 4336	4388	a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe	83
PID 4388 wrote to memory of 4336	4388	a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe	83
PID 4336 wrote to memory of 1732	4336	un792698.exe	84
PID 4336 wrote to memory of 1732	4336	un792698.exe	84
PID 4336 wrote to memory of 1732	4336	un792698.exe	84
PID 4336 wrote to memory of 4760	4336	un792698.exe	90
PID 4336 wrote to memory of 4760	4336	un792698.exe	90
PID 4336 wrote to memory of 4760	4336	un792698.exe	90

C:\Users\Admin\AppData\Local\Temp\a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe
"C:\Users\Admin\AppData\Local\Temp\a2382c294b0e79a219a5987082d85eef9d878a650cc2195035a46202cbcbcf81.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1092
      4⤵
      Program crash
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1732 -ip 1732
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exe

Filesize
536KB

MD5
83f191cf888d2ff63481cd7aeaed96fe

SHA1
d538d3ccf8ea3bbfa8153bbfb5646b28e4ba6823

SHA256
b9589edab73cb4b80317b85e8121d0bab7524f052df93912cb383c02a49e61a6

SHA512
355a64ea785dce23ca1dbd7b405ec4489d150d91aca5002415ac566577b2af37ec0dc8c6e00a90c1e46fa2811402440b49cebb5ba7e7760dcd9fb8c9365a5bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792698.exe

Filesize
536KB

MD5
83f191cf888d2ff63481cd7aeaed96fe

SHA1
d538d3ccf8ea3bbfa8153bbfb5646b28e4ba6823

SHA256
b9589edab73cb4b80317b85e8121d0bab7524f052df93912cb383c02a49e61a6

SHA512
355a64ea785dce23ca1dbd7b405ec4489d150d91aca5002415ac566577b2af37ec0dc8c6e00a90c1e46fa2811402440b49cebb5ba7e7760dcd9fb8c9365a5bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exe

Filesize
258KB

MD5
2f1d4228181655659c2a9002d249ba46

SHA1
f5e62845af7cf08033c779baa2dc40c8d5933cda

SHA256
aa615a6a4ebe2c31760306e67fd65ddaf3fd849262305edb1ed5a4131798b9a0

SHA512
64f4c7b1621ac9210424b2214eec31b97d1fb600ba8040d8b78ca4e29b85b0dbcbd94af48e304ea90d473a4e3437f1ed50a8927f12cbd6a6db6b5b1329f286f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02756733.exe

Filesize
258KB

MD5
2f1d4228181655659c2a9002d249ba46

SHA1
f5e62845af7cf08033c779baa2dc40c8d5933cda

SHA256
aa615a6a4ebe2c31760306e67fd65ddaf3fd849262305edb1ed5a4131798b9a0

SHA512
64f4c7b1621ac9210424b2214eec31b97d1fb600ba8040d8b78ca4e29b85b0dbcbd94af48e304ea90d473a4e3437f1ed50a8927f12cbd6a6db6b5b1329f286f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exe

Filesize
341KB

MD5
7231f66a0db7533f2c99e814626f2bf0

SHA1
0c6a22dde526e960b6cf359e154875cff5d0b66c

SHA256
c9adb9c5b6df7ce7b378766b74cdfe6d6570748753e064357b8d8642b3240fe8

SHA512
57f4091033f47f737ce8841a99a599fea29230619f0f7f8e4e0a181653b99e05741c229c3eec2ef9b6eb0a2d01fbc3fd7edc147df2a9ce05732734d2e44a3ee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk929973.exe

Filesize
341KB

MD5
7231f66a0db7533f2c99e814626f2bf0

SHA1
0c6a22dde526e960b6cf359e154875cff5d0b66c

SHA256
c9adb9c5b6df7ce7b378766b74cdfe6d6570748753e064357b8d8642b3240fe8

SHA512
57f4091033f47f737ce8841a99a599fea29230619f0f7f8e4e0a181653b99e05741c229c3eec2ef9b6eb0a2d01fbc3fd7edc147df2a9ce05732734d2e44a3ee0

Download Submit
memory/1732-162-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-151-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-152-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-153-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-154-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-156-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-158-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-160-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-164-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-150-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-166-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-168-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-170-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-172-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-174-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-176-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-178-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-180-0x0000000002410000-0x0000000002423000-memory.dmp

Filesize
76KB

Download
memory/1732-181-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1732-182-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-183-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-184-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1732-186-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1732-149-0x0000000004AC0000-0x0000000005064000-memory.dmp

Filesize
5.6MB

Download
memory/1732-148-0x0000000000570000-0x000000000059D000-memory.dmp

Filesize
180KB

Download
memory/4760-224-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-216-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-192-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-988-0x0000000007BC0000-0x0000000007BD2000-memory.dmp

Filesize
72KB

Download
memory/4760-197-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-200-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-202-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-199-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-198-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-204-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-206-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-208-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-210-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-212-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-214-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-191-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-218-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-220-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-222-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-226-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-194-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-228-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/4760-987-0x0000000007510000-0x0000000007B28000-memory.dmp

Filesize
6.1MB

Download
memory/4760-195-0x00000000005C0000-0x0000000000606000-memory.dmp

Filesize
280KB

Download
memory/4760-989-0x0000000007BE0000-0x0000000007CEA000-memory.dmp

Filesize
1.0MB

Download
memory/4760-990-0x0000000007D00000-0x0000000007D3C000-memory.dmp

Filesize
240KB

Download
memory/4760-991-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-993-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-994-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-995-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4760-996-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download