redline | bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
Size

746KB
MD5

32f8570e3a85e6223918d511ec015f7c
SHA1

0b1345f241a912cdbd240251c57671077300d76c
SHA256

bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7
SHA512

a1266b7ef27b13065e749ac75750d871a6375d5345140fa291876537795eda7716cd269a79133cf11dffda2c645a6425904e105b557cfd13d20258a9b234daef
SSDEEP

12288:by90Oz4F+rk0P5LThBoOaiYXZrSb/XTYb2AEQ3E/bKxnNR06Bl54TNPh0ZfTgt:bytVTYXo/X8rEOpNWugNP2hTgt

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/5056-987-0x0000000007950000-0x0000000007F68000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	69182299.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	69182299.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2136	un467407.exe
2268	69182299.exe
5056	rk403627.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	69182299.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un467407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un467407.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3304	2268	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	69182299.exe
2268	69182299.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	69182299.exe
Token: SeDebugPrivilege	5056	rk403627.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2136	4228	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	84
PID 4228 wrote to memory of 2136	4228	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	84
PID 4228 wrote to memory of 2136	4228	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	84
PID 2136 wrote to memory of 2268	2136	un467407.exe	85
PID 2136 wrote to memory of 2268	2136	un467407.exe	85
PID 2136 wrote to memory of 2268	2136	un467407.exe	85
PID 2136 wrote to memory of 5056	2136	un467407.exe	91
PID 2136 wrote to memory of 5056	2136	un467407.exe	91
PID 2136 wrote to memory of 5056	2136	un467407.exe	91

C:\Users\Admin\AppData\Local\Temp\bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
"C:\Users\Admin\AppData\Local\Temp\bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1092
      4⤵
      Program crash
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2268 -ip 2268
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
memory/2268-164-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-186-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/2268-152-0x0000000005050000-0x00000000055F4000-memory.dmp

Filesize
5.6MB

Download
memory/2268-153-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-154-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-156-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-158-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-162-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-160-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-150-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-166-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-168-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-170-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-172-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-174-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-176-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-178-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-180-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/2268-181-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/2268-182-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-183-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-184-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-151-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-149-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2268-148-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/5056-993-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-220-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-194-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-214-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-198-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-200-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-202-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-204-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-206-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-208-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-210-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-212-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-196-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-216-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-218-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-192-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-222-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-224-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-300-0x0000000000920000-0x0000000000966000-memory.dmp

Filesize
280KB

Download
memory/5056-301-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-304-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-305-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-987-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/5056-988-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/5056-989-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/5056-990-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-991-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/5056-191-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/5056-994-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5056-995-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download