redline | 52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4

General

Target

52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Size

480KB
MD5

20d04c1821001d935d8ab428d07f5b3f
SHA1

a0f3de5c6fd5a77f69b2968f06658b53ed4c8496
SHA256

52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4
SHA512

3f4fe8241d327aa6d000641aef14848564e9a23ea8e178fc77832a334d484f709241b2fb701cb3d0ebd7e287b62c209b181260eaf71767f92b989732434e169a
SSDEEP

12288:7Mrmy90FSy38Te3E2PBa2lcg7jBe3/HI:RycpDfb2/HI

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3032-186-0x0000000007740000-0x0000000007D58000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5630612.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4988	y4958066.exe
3452	k5630612.exe
3032	l1751665.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5630612.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4958066.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4958066.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	k5630612.exe
3452	k5630612.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	k5630612.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4988	956	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	80
PID 956 wrote to memory of 4988	956	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	80
PID 956 wrote to memory of 4988	956	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	80
PID 4988 wrote to memory of 3452	4988	y4958066.exe	81
PID 4988 wrote to memory of 3452	4988	y4958066.exe	81
PID 4988 wrote to memory of 3452	4988	y4958066.exe	81
PID 4988 wrote to memory of 3032	4988	y4958066.exe	83
PID 4988 wrote to memory of 3032	4988	y4958066.exe	83
PID 4988 wrote to memory of 3032	4988	y4958066.exe	83

C:\Users\Admin\AppData\Local\Temp\52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
"C:\Users\Admin\AppData\Local\Temp\52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe
    3⤵
    - Executes dropped EXE
    PID:3032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
memory/3032-189-0x0000000004CC0000-0x0000000004CFC000-memory.dmp

Filesize
240KB

Download
memory/3032-188-0x00000000072F0000-0x00000000073FA000-memory.dmp

Filesize
1.0MB

Download
memory/3032-187-0x00000000071C0000-0x00000000071D2000-memory.dmp

Filesize
72KB

Download
memory/3032-186-0x0000000007740000-0x0000000007D58000-memory.dmp

Filesize
6.1MB

Download
memory/3032-185-0x0000000000490000-0x00000000004B8000-memory.dmp

Filesize
160KB

Download
memory/3032-190-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3032-191-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3452-169-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-180-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3452-167-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-163-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-171-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-173-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-176-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3452-177-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3452-178-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3452-175-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-179-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3452-165-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-161-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-159-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-157-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-155-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-153-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-151-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-149-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-148-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/3452-147-0x0000000004B80000-0x0000000005124000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads