redline | dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce

General

Target

dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe
Size

707KB
MD5

8247238d9a9e2d2a320288651b3497e3
SHA1

b4725616e944457e7449f966eea8978bdcd8be07
SHA256

dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce
SHA512

c448dde83219eefb5b934732c41dc35afd6a48e06fdc86ffec6f2c0a7d8f6cb3f93ac1263aceef43247cea88706c615e47dbcdf1730dca8d279d955d2bf8ed78
SSDEEP

12288:nMrNy90+Pf1KhTmu3lQUrn9oShNjgJiyVpfrG74W4Jiz2qq68kE:eyhn15ilz2SI4y3fSMWYCqWE

Score

10^/10

redline discovery infostealer persistence spyware stealer

Malware Config

Signatures

Detects Redline Stealer samples 3 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/1428-148-0x0000000008110000-0x0000000008728000-memory.dmp	redline_stealer
behavioral2/memory/1428-154-0x0000000008080000-0x00000000080E6000-memory.dmp	redline_stealer
behavioral2/memory/1428-158-0x0000000008E80000-0x0000000009042000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4824	x9919649.exe
1428	g5256864.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x9919649.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9919649.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	g5256864.exe
1428	g5256864.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	g5256864.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4824	5112	dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe	79
PID 5112 wrote to memory of 4824	5112	dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe	79
PID 5112 wrote to memory of 4824	5112	dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe	79
PID 4824 wrote to memory of 1428	4824	x9919649.exe	80
PID 4824 wrote to memory of 1428	4824	x9919649.exe	80
PID 4824 wrote to memory of 1428	4824	x9919649.exe	80

C:\Users\Admin\AppData\Local\Temp\dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe
"C:\Users\Admin\AppData\Local\Temp\dc49b05b71d0467bc50265f890734eeada2cd652292890b32300767a7d6638ce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9919649.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9919649.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5256864.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5256864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9919649.exe

Filesize
416KB

MD5
ace1eb70caee68cc2d5fee1b7023b45c

SHA1
cf8a6b1dba4196fe76a336d9acbad6f4ff3ba50e

SHA256
383b2ee222edd41c189cae4965d7b7cb10cb79a83a97d1f7d02997c6eb18258f

SHA512
598a80b0acc3ae5065cfc3efc57075da1f71b4f0c9891c46d72c02252ac55aed6858b248ef06071d9f67189e49387b0a1378fea7ff22d421c5dbe94703ee3636

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9919649.exe

Filesize
416KB

MD5
ace1eb70caee68cc2d5fee1b7023b45c

SHA1
cf8a6b1dba4196fe76a336d9acbad6f4ff3ba50e

SHA256
383b2ee222edd41c189cae4965d7b7cb10cb79a83a97d1f7d02997c6eb18258f

SHA512
598a80b0acc3ae5065cfc3efc57075da1f71b4f0c9891c46d72c02252ac55aed6858b248ef06071d9f67189e49387b0a1378fea7ff22d421c5dbe94703ee3636

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5256864.exe

Filesize
136KB

MD5
a8bce2591d56d765d792d8b6b7cbd9ee

SHA1
be9c6756852c9edf30ac7afff362e28d27367433

SHA256
8f7cb9ef8ed5660a4ffdaaaec4ab770dbd24f16f594e52fa2df661ae3fed80cd

SHA512
d3069fdc393333e3074a281a86d1c0b63c56af2ef26c62b113cbb323927fb133889d8816576414d3062c4b38f066945fa00338e1551412224160fb27a4567a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5256864.exe

Filesize
136KB

MD5
a8bce2591d56d765d792d8b6b7cbd9ee

SHA1
be9c6756852c9edf30ac7afff362e28d27367433

SHA256
8f7cb9ef8ed5660a4ffdaaaec4ab770dbd24f16f594e52fa2df661ae3fed80cd

SHA512
d3069fdc393333e3074a281a86d1c0b63c56af2ef26c62b113cbb323927fb133889d8816576414d3062c4b38f066945fa00338e1551412224160fb27a4567a5d

Download Submit
memory/1428-147-0x0000000000CF0000-0x0000000000D18000-memory.dmp

Filesize
160KB

Download
memory/1428-148-0x0000000008110000-0x0000000008728000-memory.dmp

Filesize
6.1MB

Download
memory/1428-149-0x0000000007B40000-0x0000000007B52000-memory.dmp

Filesize
72KB

Download
memory/1428-150-0x0000000007C70000-0x0000000007D7A000-memory.dmp

Filesize
1.0MB

Download
memory/1428-151-0x0000000007BE0000-0x0000000007C1C000-memory.dmp

Filesize
240KB

Download
memory/1428-152-0x0000000007BD0000-0x0000000007BE0000-memory.dmp

Filesize
64KB

Download
memory/1428-153-0x0000000007BD0000-0x0000000007BE0000-memory.dmp

Filesize
64KB

Download
memory/1428-154-0x0000000008080000-0x00000000080E6000-memory.dmp

Filesize
408KB

Download
memory/1428-155-0x0000000008B10000-0x0000000008BA2000-memory.dmp

Filesize
584KB

Download
memory/1428-156-0x0000000009160000-0x0000000009704000-memory.dmp

Filesize
5.6MB

Download
memory/1428-157-0x0000000008C30000-0x0000000008CA6000-memory.dmp

Filesize
472KB

Download
memory/1428-158-0x0000000008E80000-0x0000000009042000-memory.dmp

Filesize
1.8MB

Download
memory/1428-159-0x0000000009C40000-0x000000000A16C000-memory.dmp

Filesize
5.2MB

Download
memory/1428-160-0x0000000002FB0000-0x0000000002FCE000-memory.dmp

Filesize
120KB

Download
memory/1428-161-0x0000000008DB0000-0x0000000008E00000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing