redline | 598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b

General

Target

598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
Size

308KB
MD5

1ea303047c2d631108e382977400e8aa
SHA1

455cce5c4f0f948de08dbb6950ddac242514233d
SHA256

598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b
SHA512

bd0d43d40006a78e696dc7afefea9fe551fc5925261fa220fc5236c6de87a4faf3abefe3dc8533d689ebd5a64aa9a2af47cbc32ec266638b5fe04b9cefaec161
SSDEEP

6144:Kky+bnr+1p0yN90QEnlEY+zbPsL4JfR7wDvROxnGgjK0MVLY:cMrhy909b+zYemgxxjK0MxY

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/424-181-0x00000000079E0000-0x0000000007FF8000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g5060263.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1788	g5060263.exe
424	h9602166.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g5060263.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	g5060263.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	g5060263.exe
1788	g5060263.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	g5060263.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 1788	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	81
PID 2760 wrote to memory of 1788	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	81
PID 2760 wrote to memory of 1788	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	81
PID 2760 wrote to memory of 424	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	82
PID 2760 wrote to memory of 424	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	82
PID 2760 wrote to memory of 424	2760	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	82

C:\Users\Admin\AppData\Local\Temp\598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
"C:\Users\Admin\AppData\Local\Temp\598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe
  2⤵
  - Executes dropped EXE
  PID:424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
memory/424-186-0x0000000007830000-0x0000000007840000-memory.dmp

Filesize
64KB

Download
memory/424-185-0x0000000007830000-0x0000000007840000-memory.dmp

Filesize
64KB

Download
memory/424-184-0x00000000074B0000-0x00000000074EC000-memory.dmp

Filesize
240KB

Download
memory/424-183-0x0000000007580000-0x000000000768A000-memory.dmp

Filesize
1.0MB

Download
memory/424-182-0x0000000007450000-0x0000000007462000-memory.dmp

Filesize
72KB

Download
memory/424-181-0x00000000079E0000-0x0000000007FF8000-memory.dmp

Filesize
6.1MB

Download
memory/424-180-0x0000000000720000-0x0000000000748000-memory.dmp

Filesize
160KB

Download
memory/1788-148-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-174-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/1788-158-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-160-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-162-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-164-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-166-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-168-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-170-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-172-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-173-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/1788-156-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-175-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/1788-154-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-152-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-150-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-146-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-145-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/1788-144-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/1788-143-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/1788-142-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/1788-141-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads