redline | bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe
Size

934KB
MD5

455d3d47c2b9e8970c9a0b70bc7bfc7f
SHA1

9354b50776cb2c6437586becdc69c87266a9a806
SHA256

bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f
SHA512

f821fbd07a59930629cb4c4d5f6434ad372d4040b3195a1427545d51738ae65d62bc48af8e5394a6b1c61cab1ae10ae7105de674f3340650a19e2c0983338722
SSDEEP

24576:9ySH1lXniloIBIxGbS+as2mL8kjIYhxITqdgyqgRD:YSvniyI0WSc2lT4qgR

Score

10^/10

redline dark evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/2660-4462-0x000000000B100000-0x000000000B718000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	75216687.exe

Executes dropped EXE 5 IoCs

pid	Process
4988	un621821.exe
1768	75216687.exe
560	1.exe
1640	rk689631.exe
2660	si255650.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un621821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un621821.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3660	1768	WerFault.exe	83
3236	1640	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
560	1.exe
560	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	75216687.exe
Token: SeDebugPrivilege	560	1.exe
Token: SeDebugPrivilege	1640	rk689631.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4988	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	82
PID 1696 wrote to memory of 4988	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	82
PID 1696 wrote to memory of 4988	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	82
PID 4988 wrote to memory of 1768	4988	un621821.exe	83
PID 4988 wrote to memory of 1768	4988	un621821.exe	83
PID 4988 wrote to memory of 1768	4988	un621821.exe	83
PID 1768 wrote to memory of 560	1768	75216687.exe	84
PID 1768 wrote to memory of 560	1768	75216687.exe	84
PID 4988 wrote to memory of 1640	4988	un621821.exe	87
PID 4988 wrote to memory of 1640	4988	un621821.exe	87
PID 4988 wrote to memory of 1640	4988	un621821.exe	87
PID 1696 wrote to memory of 2660	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	97
PID 1696 wrote to memory of 2660	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	97
PID 1696 wrote to memory of 2660	1696	bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe	97

C:\Users\Admin\AppData\Local\Temp\bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe
"C:\Users\Admin\AppData\Local\Temp\bb428916a7dec676ed480506a147282be4e39477e43d0c4c393bdd07fe337f1f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621821.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621821.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\75216687.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\75216687.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1384
      4⤵
      Program crash
      PID:3660
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk689631.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk689631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 1272
      4⤵
      Program crash
      PID:3236
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si255650.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si255650.exe
  2⤵
  - Executes dropped EXE
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1768 -ip 1768
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1640 -ip 1640
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si255650.exe

Filesize
170KB

MD5
490042ebef3e77da4daccbab86acafd0

SHA1
4f8e1ababbb65efc858546cdb61e15ed4fd2dc7c

SHA256
cff72b46995c3dc07cc1ea0d60242eadcdb69671f6c08412251715fbcb76b454

SHA512
3d71976e1901ec6c164d65525b77b7c5141b0aba05db59bf1f4ad489182a598f5c49b3365911e1281f7b419481be9d3802f1fcdbe586bbc79b3d3bb043ae0b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si255650.exe

Filesize
170KB

MD5
490042ebef3e77da4daccbab86acafd0

SHA1
4f8e1ababbb65efc858546cdb61e15ed4fd2dc7c

SHA256
cff72b46995c3dc07cc1ea0d60242eadcdb69671f6c08412251715fbcb76b454

SHA512
3d71976e1901ec6c164d65525b77b7c5141b0aba05db59bf1f4ad489182a598f5c49b3365911e1281f7b419481be9d3802f1fcdbe586bbc79b3d3bb043ae0b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621821.exe

Filesize
781KB

MD5
b6a6f3cf6599ad655efd81da2ead0987

SHA1
65d1ed08992ca747029cd93033498fcfaf25c180

SHA256
cb2f0ac01e6a17f0abf23307288bf44b2a65d7cf77f12115c222c1dae64cdc63

SHA512
03ad98e87a1d53b71c3a06e162726086e017f512be602b6b03b98e2d2659bb0417b85485df5f3b903e2d2415776d517dd712ce26f4063400c21775ce984208c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621821.exe

Filesize
781KB

MD5
b6a6f3cf6599ad655efd81da2ead0987

SHA1
65d1ed08992ca747029cd93033498fcfaf25c180

SHA256
cb2f0ac01e6a17f0abf23307288bf44b2a65d7cf77f12115c222c1dae64cdc63

SHA512
03ad98e87a1d53b71c3a06e162726086e017f512be602b6b03b98e2d2659bb0417b85485df5f3b903e2d2415776d517dd712ce26f4063400c21775ce984208c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\75216687.exe

Filesize
516KB

MD5
a9915da13763a87b0d731ca37c2b92c6

SHA1
900861a16ee9ebe3a8da186443b19c0817ee26a2

SHA256
03208e438227b4ea372c79232275ae80f6593c36d2140064cfaf3bba98e43a60

SHA512
af3c14fa30a3403ed23ddfe78754ea93ab23e55c70ab5b1f68220ee3ccdef384dd18f4622f1d9b51d6b8c1e198204e9e73eae633f876d6f20c2c8ef5e10e011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\75216687.exe

Filesize
516KB

MD5
a9915da13763a87b0d731ca37c2b92c6

SHA1
900861a16ee9ebe3a8da186443b19c0817ee26a2

SHA256
03208e438227b4ea372c79232275ae80f6593c36d2140064cfaf3bba98e43a60

SHA512
af3c14fa30a3403ed23ddfe78754ea93ab23e55c70ab5b1f68220ee3ccdef384dd18f4622f1d9b51d6b8c1e198204e9e73eae633f876d6f20c2c8ef5e10e011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk689631.exe

Filesize
576KB

MD5
9985a39dce22f75953b18909b2720ad2

SHA1
caa42480dacfc948ad9aa3a78b69050c8c5cc89d

SHA256
59b662b34599ad430b9674462e4867549fb25096a3dbbbec98a66df7a3421317

SHA512
3d2a2a24f0c3ba1f4055e48d52b237df05c0cff6e0249596aa628fbc8c96cb078ca38516462938e6c5ea1206580e22b893f220fe0e260f5b4e104d08c59bf0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk689631.exe

Filesize
576KB

MD5
9985a39dce22f75953b18909b2720ad2

SHA1
caa42480dacfc948ad9aa3a78b69050c8c5cc89d

SHA256
59b662b34599ad430b9674462e4867549fb25096a3dbbbec98a66df7a3421317

SHA512
3d2a2a24f0c3ba1f4055e48d52b237df05c0cff6e0249596aa628fbc8c96cb078ca38516462938e6c5ea1206580e22b893f220fe0e260f5b4e104d08c59bf0d4

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/560-2294-0x0000000000F30000-0x0000000000F3A000-memory.dmp

Filesize
40KB

Download
memory/1640-2408-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/1640-2410-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/1640-2405-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/1640-2404-0x00000000021F0000-0x000000000224B000-memory.dmp

Filesize
364KB

Download
memory/1640-4452-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/1640-4454-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/1768-168-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-216-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-176-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/1768-178-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/1768-177-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-180-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-182-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-184-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-186-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-188-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-190-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-192-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-194-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-196-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-198-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-200-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-202-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-204-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-206-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-208-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-210-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-212-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-214-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-174-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-2282-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/1768-172-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-170-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-166-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-164-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-2296-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/1768-162-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-160-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-158-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-156-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-154-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-152-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-151-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1768-150-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/1768-149-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/1768-148-0x00000000009A0000-0x00000000009EC000-memory.dmp

Filesize
304KB

Download
memory/2660-4461-0x0000000000E40000-0x0000000000E70000-memory.dmp

Filesize
192KB

Download
memory/2660-4462-0x000000000B100000-0x000000000B718000-memory.dmp

Filesize
6.1MB

Download
memory/2660-4463-0x000000000AC80000-0x000000000AD8A000-memory.dmp

Filesize
1.0MB

Download
memory/2660-4464-0x000000000ABB0000-0x000000000ABC2000-memory.dmp

Filesize
72KB

Download
memory/2660-4465-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/2660-4466-0x000000000AC10000-0x000000000AC4C000-memory.dmp

Filesize
240KB

Download
memory/2660-4467-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download