redline | ab409ce8637bb2fc4dbbf909af3bd9b236272448b6d5e28d8ceb197a10d173bd

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe
Size

1.0MB
MD5

fb14cf3dd84d331ed72129de2a093f16
SHA1

5cddc307f102158e0a091b2fa38bc64fa4c09fd8
SHA256

ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10
SHA512

bd19a4989dea36fc0d82d8236c5bf550c8238d6dc918ec7d3448a3c181cd35df7239e1d5dc0052e089976086698e42f2340edf4b159d4f3e3bca127befe1d226
SSDEEP

24576:Hy8NLbMkSWsyEPh9NDRtC26hSW7jvFnyn:S8NLbMkjEZ9N7C26sWdy

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/2168-964-0x0000000009C70000-0x000000000A288000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4642.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4642.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4642.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4642.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4642.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4642.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
3748	za912166.exe
4172	za907615.exe
3332	za897037.exe
4608	tz4642.exe
2168	v9344GW.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4642.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za912166.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	za912166.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za907615.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	za907615.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za897037.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	za897037.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	tz4642.exe
4608	tz4642.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	tz4642.exe
Token: SeDebugPrivilege	2168	v9344GW.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3748	60	ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe	83
PID 60 wrote to memory of 3748	60	ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe	83
PID 60 wrote to memory of 3748	60	ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe	83
PID 3748 wrote to memory of 4172	3748	za912166.exe	84
PID 3748 wrote to memory of 4172	3748	za912166.exe	84
PID 3748 wrote to memory of 4172	3748	za912166.exe	84
PID 4172 wrote to memory of 3332	4172	za907615.exe	85
PID 4172 wrote to memory of 3332	4172	za907615.exe	85
PID 4172 wrote to memory of 3332	4172	za907615.exe	85
PID 3332 wrote to memory of 4608	3332	za897037.exe	86
PID 3332 wrote to memory of 4608	3332	za897037.exe	86
PID 3332 wrote to memory of 2168	3332	za897037.exe	90
PID 3332 wrote to memory of 2168	3332	za897037.exe	90
PID 3332 wrote to memory of 2168	3332	za897037.exe	90

C:\Users\Admin\AppData\Local\Temp\ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe
"C:\Users\Admin\AppData\Local\Temp\ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:60
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za912166.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za912166.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za907615.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za907615.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897037.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897037.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4642.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4642.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9344GW.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9344GW.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za912166.exe

Filesize
865KB

MD5
ca7e3adf1b94e9ffabc3e9f117955d47

SHA1
b5fab4c1476185e50d81f93a7fccd46fe9bbc292

SHA256
d0c24e50bb14c48e66d4d428170a80e50eb0f2993b3f15fe760edd896ba4840a

SHA512
69003c5448f08b18c1b9d05f71d194e7b509dea23273b9eb636dff09e8547670fd7dd57080d8b28e88e367d7cf1c4078d084dc5b2b27162ad0024686820b23a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za912166.exe

Filesize
865KB

MD5
ca7e3adf1b94e9ffabc3e9f117955d47

SHA1
b5fab4c1476185e50d81f93a7fccd46fe9bbc292

SHA256
d0c24e50bb14c48e66d4d428170a80e50eb0f2993b3f15fe760edd896ba4840a

SHA512
69003c5448f08b18c1b9d05f71d194e7b509dea23273b9eb636dff09e8547670fd7dd57080d8b28e88e367d7cf1c4078d084dc5b2b27162ad0024686820b23a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za907615.exe

Filesize
694KB

MD5
2aa263b8aa3d0be71c0164ee08423847

SHA1
eb3ea237da2668de8de4c65cd57dc3b5d7efd4b3

SHA256
8d784a666f522f0ec605fb16ee6acffd593bd44a2889d4c1256c08768918ae86

SHA512
4292e83e0c1077aac9409af2e9ef5a5d3b30bc9a653f01ee48a515fdcd5829ae4b7345c06a41d2eeae9f54743f882431ce40a1d271d657c9e50eacd39339e479

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za907615.exe

Filesize
694KB

MD5
2aa263b8aa3d0be71c0164ee08423847

SHA1
eb3ea237da2668de8de4c65cd57dc3b5d7efd4b3

SHA256
8d784a666f522f0ec605fb16ee6acffd593bd44a2889d4c1256c08768918ae86

SHA512
4292e83e0c1077aac9409af2e9ef5a5d3b30bc9a653f01ee48a515fdcd5829ae4b7345c06a41d2eeae9f54743f882431ce40a1d271d657c9e50eacd39339e479

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897037.exe

Filesize
414KB

MD5
f802fdab7ab1f3f94b58dcd078f97bd0

SHA1
c89c6ba7585f19288233ee2e331927939f562f0f

SHA256
55e8ebaac67d64552c1f532243ebfd7b17c45e3731f6071a72c34c12aa1f74dd

SHA512
b4d0f19264f8ea4cbfa591d9991f52acc23b48a8cda82362d8c2449285b2f562bfa916df33cc1a354e99dbaf357304d56c7048238feb0745caea63581465ef1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897037.exe

Filesize
414KB

MD5
f802fdab7ab1f3f94b58dcd078f97bd0

SHA1
c89c6ba7585f19288233ee2e331927939f562f0f

SHA256
55e8ebaac67d64552c1f532243ebfd7b17c45e3731f6071a72c34c12aa1f74dd

SHA512
b4d0f19264f8ea4cbfa591d9991f52acc23b48a8cda82362d8c2449285b2f562bfa916df33cc1a354e99dbaf357304d56c7048238feb0745caea63581465ef1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4642.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4642.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9344GW.exe

Filesize
362KB

MD5
72eb3530bf3886ab16208022048c59a6

SHA1
4933bb4acd98dd106825b825770361882e80557a

SHA256
bae1d3c32a7153645aea0608932a5bd66d0efd3539a4dffb50ff9e22e6063e21

SHA512
c3a29f56d25fa77a861a0e02392ab2b18d5c859a5f70264a7a1cbd3dd8d9e43c6d32ac5b22e297f2e1a4c40f7746c618da6390f0f31886e49ae23658a8bb54e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9344GW.exe

Filesize
362KB

MD5
72eb3530bf3886ab16208022048c59a6

SHA1
4933bb4acd98dd106825b825770361882e80557a

SHA256
bae1d3c32a7153645aea0608932a5bd66d0efd3539a4dffb50ff9e22e6063e21

SHA512
c3a29f56d25fa77a861a0e02392ab2b18d5c859a5f70264a7a1cbd3dd8d9e43c6d32ac5b22e297f2e1a4c40f7746c618da6390f0f31886e49ae23658a8bb54e1

Download Submit
memory/2168-167-0x0000000002CF0000-0x0000000002D36000-memory.dmp

Filesize
280KB

Download
memory/2168-168-0x0000000007340000-0x00000000078E4000-memory.dmp

Filesize
5.6MB

Download
memory/2168-169-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-170-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-172-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-174-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-176-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-178-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-180-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-182-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-184-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-186-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-188-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-190-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-192-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-194-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-196-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-200-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-198-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-202-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-203-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-199-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-205-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-207-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-209-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-211-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-213-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-215-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-219-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-217-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-221-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-223-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-225-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-227-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-229-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-231-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-233-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-235-0x00000000071A0000-0x00000000071D5000-memory.dmp

Filesize
212KB

Download
memory/2168-964-0x0000000009C70000-0x000000000A288000-memory.dmp

Filesize
6.1MB

Download
memory/2168-965-0x000000000A320000-0x000000000A332000-memory.dmp

Filesize
72KB

Download
memory/2168-966-0x000000000A340000-0x000000000A44A000-memory.dmp

Filesize
1.0MB

Download
memory/2168-967-0x000000000A470000-0x000000000A4AC000-memory.dmp

Filesize
240KB

Download
memory/2168-968-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-970-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-971-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-972-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2168-973-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/4608-161-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download