redline | ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
Size

893KB
MD5

8ea65de7db607d2bf1e2a76dcf654a81
SHA1

1a050bdaade0496202324a541f481c10e865f7b2
SHA256

ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab
SHA512

9b21e56aca0985a5a0d12fbf3e317bf22f43a31082f2f7e4eb8efe291fb21db45efb370ee62f2b26f5d00b070b1d53c2817b2dc2fb8eeaabe14f6ba5589e6359
SSDEEP

24576:oyThxqXKYJmHveucaQtGfmvjuOumcw+j6Hdo:vdWbPtI5/mcS

Score

10^/10

redline dark evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4100-4457-0x0000000005950000-0x0000000005F68000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	81214228.exe

Executes dropped EXE 5 IoCs

pid	Process
4644	st983673.exe
1376	81214228.exe
3436	1.exe
5076	kp143355.exe
4100	lr877551.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st983673.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st983673.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	5076	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	1.exe
3436	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	81214228.exe
Token: SeDebugPrivilege	3436	1.exe
Token: SeDebugPrivilege	5076	kp143355.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4644	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	83
PID 4936 wrote to memory of 4644	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	83
PID 4936 wrote to memory of 4644	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	83
PID 4644 wrote to memory of 1376	4644	st983673.exe	84
PID 4644 wrote to memory of 1376	4644	st983673.exe	84
PID 4644 wrote to memory of 1376	4644	st983673.exe	84
PID 1376 wrote to memory of 3436	1376	81214228.exe	88
PID 1376 wrote to memory of 3436	1376	81214228.exe	88
PID 4644 wrote to memory of 5076	4644	st983673.exe	89
PID 4644 wrote to memory of 5076	4644	st983673.exe	89
PID 4644 wrote to memory of 5076	4644	st983673.exe	89
PID 4936 wrote to memory of 4100	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	94
PID 4936 wrote to memory of 4100	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	94
PID 4936 wrote to memory of 4100	4936	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	94

C:\Users\Admin\AppData\Local\Temp\ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
"C:\Users\Admin\AppData\Local\Temp\ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st983673.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st983673.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\81214228.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\81214228.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3436
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp143355.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp143355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 1260
      4⤵
      Program crash
      PID:540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr877551.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr877551.exe
  2⤵
  - Executes dropped EXE
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5076 -ip 5076
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr877551.exe

Filesize
169KB

MD5
adbd502c3603507672924e7e96ce71d2

SHA1
ac7c20b1ecc7044a87dde1e863e8078134fc2ed2

SHA256
d7047bb7c62753eac8bfe64d60504a7f1ba1eb2be976bab164aacd90d104a748

SHA512
9666798f006f3059372bbd1a337f91680f03d7fd4eab62218b0df83ba55cf6f4e891cdb373b3fd07867e1302fe959c1bba816d809dfbdc91d41d26a2d5c21497

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr877551.exe

Filesize
169KB

MD5
adbd502c3603507672924e7e96ce71d2

SHA1
ac7c20b1ecc7044a87dde1e863e8078134fc2ed2

SHA256
d7047bb7c62753eac8bfe64d60504a7f1ba1eb2be976bab164aacd90d104a748

SHA512
9666798f006f3059372bbd1a337f91680f03d7fd4eab62218b0df83ba55cf6f4e891cdb373b3fd07867e1302fe959c1bba816d809dfbdc91d41d26a2d5c21497

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st983673.exe

Filesize
739KB

MD5
f821bb32cff0e3ee727ae92cf87fe8bf

SHA1
4204f5a1407a56418ca86b9fa8acaabbfa725867

SHA256
ab7a80b4a386400e1c6f8f043df3c9c426ee86e975955c6e01715b3742d89de2

SHA512
c4e5d2d908ca51affffc22fac96bb950ec930af4b73dca8af8f02aff9157122d34c2a715a7942b679db3a8910f62110fe282833217e8a9c33ca031c288febad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st983673.exe

Filesize
739KB

MD5
f821bb32cff0e3ee727ae92cf87fe8bf

SHA1
4204f5a1407a56418ca86b9fa8acaabbfa725867

SHA256
ab7a80b4a386400e1c6f8f043df3c9c426ee86e975955c6e01715b3742d89de2

SHA512
c4e5d2d908ca51affffc22fac96bb950ec930af4b73dca8af8f02aff9157122d34c2a715a7942b679db3a8910f62110fe282833217e8a9c33ca031c288febad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\81214228.exe

Filesize
301KB

MD5
89ca6f133007c7eed7596bd79c27f428

SHA1
aa6d8d9190752496908753696646bd40961516cc

SHA256
c1bccfe02be880e9710b249dae8049d487a08f63de357c337973701aba6bc0ab

SHA512
15220ca927aa318a146c2350d76c6a9d0a19f6d4468e19821346a0992c882fb7a3bfa9c784220b31b09e34f8a90b8960cc91102c32b50577e4bf0934f0a5e37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\81214228.exe

Filesize
301KB

MD5
89ca6f133007c7eed7596bd79c27f428

SHA1
aa6d8d9190752496908753696646bd40961516cc

SHA256
c1bccfe02be880e9710b249dae8049d487a08f63de357c337973701aba6bc0ab

SHA512
15220ca927aa318a146c2350d76c6a9d0a19f6d4468e19821346a0992c882fb7a3bfa9c784220b31b09e34f8a90b8960cc91102c32b50577e4bf0934f0a5e37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp143355.exe

Filesize
581KB

MD5
21690147cec837d5c27b34e937d22788

SHA1
225c15b3f7b744f2ba7fbd34259157011a451e44

SHA256
d59cc1d07723d5cbf8e1610f68c1f081bb9c92a2df2e58b6822d015afb90a5c4

SHA512
caa2c037500b50b5ab850a80c61f816fcbd9e8814ddbcac69b0c6a81395e927340a090073560011f0ef183a7e478db82922e83208379c90e788e36598630f2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp143355.exe

Filesize
581KB

MD5
21690147cec837d5c27b34e937d22788

SHA1
225c15b3f7b744f2ba7fbd34259157011a451e44

SHA256
d59cc1d07723d5cbf8e1610f68c1f081bb9c92a2df2e58b6822d015afb90a5c4

SHA512
caa2c037500b50b5ab850a80c61f816fcbd9e8814ddbcac69b0c6a81395e927340a090073560011f0ef183a7e478db82922e83208379c90e788e36598630f2c1

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1376-186-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-198-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-152-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-154-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-156-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-158-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-162-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-160-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-164-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-168-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-166-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-170-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-172-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-174-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-176-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-178-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-180-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-182-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-184-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-149-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-188-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-190-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-192-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-194-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-196-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-150-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-200-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-202-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-204-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-206-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-208-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-210-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-212-0x0000000004F80000-0x0000000004FD1000-memory.dmp

Filesize
324KB

Download
memory/1376-2285-0x00000000049C0000-0x00000000049D0000-memory.dmp

Filesize
64KB

Download
memory/1376-147-0x00000000049C0000-0x00000000049D0000-memory.dmp

Filesize
64KB

Download
memory/1376-148-0x00000000049D0000-0x0000000004F74000-memory.dmp

Filesize
5.6MB

Download
memory/3436-2293-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/4100-4456-0x0000000000940000-0x0000000000970000-memory.dmp

Filesize
192KB

Download
memory/4100-4462-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4100-4461-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4100-4460-0x0000000005430000-0x000000000546C000-memory.dmp

Filesize
240KB

Download
memory/4100-4459-0x00000000053D0000-0x00000000053E2000-memory.dmp

Filesize
72KB

Download
memory/4100-4458-0x00000000054A0000-0x00000000055AA000-memory.dmp

Filesize
1.0MB

Download
memory/4100-4457-0x0000000005950000-0x0000000005F68000-memory.dmp

Filesize
6.1MB

Download
memory/5076-4447-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/5076-2330-0x0000000000930000-0x000000000098B000-memory.dmp

Filesize
364KB

Download
memory/5076-4449-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/5076-4448-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/5076-2332-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/5076-4446-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/5076-2333-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download