redline | 6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f

General

Target

6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe
Size

565KB
MD5

358bc492b89a189577f11d4f77ac89b4
SHA1

509acdae84acd2e8f053e9756b794c248fc3cd79
SHA256

6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f
SHA512

5df0fd26c1e16d643209528c67db23bcdfa7847e6f9c8cb7564e95fe9766ffa82faa59161ab34c4d61ad5b46ddf1f56761099fb8a998cbf606dccb92c9d0eac8
SSDEEP

12288:zMrIy90XGYyAel32z/qgfb0UksOZSWiE4YKsF9OK2zakQ:TyNYN627BfwNDRJFT6akQ

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3576-194-0x0000000008240000-0x0000000008858000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8688582.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1136	v9600108.exe
1056	a8688582.exe
3576	b7762460.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a8688582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8688582.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9600108.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9600108.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1056	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	a8688582.exe
1056	a8688582.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	a8688582.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1136	2868	6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe	86
PID 2868 wrote to memory of 1136	2868	6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe	86
PID 2868 wrote to memory of 1136	2868	6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe	86
PID 1136 wrote to memory of 1056	1136	v9600108.exe	87
PID 1136 wrote to memory of 1056	1136	v9600108.exe	87
PID 1136 wrote to memory of 1056	1136	v9600108.exe	87
PID 1136 wrote to memory of 3576	1136	v9600108.exe	91
PID 1136 wrote to memory of 3576	1136	v9600108.exe	91
PID 1136 wrote to memory of 3576	1136	v9600108.exe	91

C:\Users\Admin\AppData\Local\Temp\6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe
"C:\Users\Admin\AppData\Local\Temp\6b02adf248b00f8b3ad6365c5c7a257ea16138890d0610b5f840cd7db9791f6f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9600108.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9600108.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8688582.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8688582.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1080
      4⤵
      Program crash
      PID:1072
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7762460.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7762460.exe
    3⤵
    - Executes dropped EXE
    PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1056 -ip 1056
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9600108.exe

Filesize
393KB

MD5
39b0bd8a423a4eb28e2be1d7d3889c0a

SHA1
d9b26bdff900f7bd25caaaf9bc934020c7f5efea

SHA256
4f7e489be151adf48f38cb5f300f198e97ed2fe472e95f1eca822fd0670aa0de

SHA512
56f27ca6418c09326edc0474824778ba0c32f8116871e20646ad1cd9f82966b83aa760e4dc1145e7ff6095d8ff4a07cebbaca632553437908779f6fe14c7f141

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9600108.exe

Filesize
393KB

MD5
39b0bd8a423a4eb28e2be1d7d3889c0a

SHA1
d9b26bdff900f7bd25caaaf9bc934020c7f5efea

SHA256
4f7e489be151adf48f38cb5f300f198e97ed2fe472e95f1eca822fd0670aa0de

SHA512
56f27ca6418c09326edc0474824778ba0c32f8116871e20646ad1cd9f82966b83aa760e4dc1145e7ff6095d8ff4a07cebbaca632553437908779f6fe14c7f141

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8688582.exe

Filesize
314KB

MD5
e99b46e94803bc6efa5e6271cf5bfe9a

SHA1
5b3d2ac5ec4fb34870d9d369acbe1354dcf475a1

SHA256
17ac6c8884d444237f60eaa1c0f814911e6cb11647274ff1411644491fdafa76

SHA512
fa3a6683b25c9654b24a86e7302283cb117b879a66d50912651302331532df9e48bb727057cc54732a71d7ff71fd8e0a4bd0b82094a97c7dd54951b46a020243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8688582.exe

Filesize
314KB

MD5
e99b46e94803bc6efa5e6271cf5bfe9a

SHA1
5b3d2ac5ec4fb34870d9d369acbe1354dcf475a1

SHA256
17ac6c8884d444237f60eaa1c0f814911e6cb11647274ff1411644491fdafa76

SHA512
fa3a6683b25c9654b24a86e7302283cb117b879a66d50912651302331532df9e48bb727057cc54732a71d7ff71fd8e0a4bd0b82094a97c7dd54951b46a020243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7762460.exe

Filesize
136KB

MD5
30d0ee0947be55272def37f502e40d83

SHA1
67dec087565870ddbba362f33bc909491d56f0d7

SHA256
876c00366d8cdda682030628307cbcbd8a90ffc831cb0176173207b36bf28514

SHA512
0b98ba7648398642441894a970d889d0d4769317531473def2decb847bdb9472b0b3671f96126ad7ad023d4a434cbcef8da7c8663df718dcf6ee3557874ad284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7762460.exe

Filesize
136KB

MD5
30d0ee0947be55272def37f502e40d83

SHA1
67dec087565870ddbba362f33bc909491d56f0d7

SHA256
876c00366d8cdda682030628307cbcbd8a90ffc831cb0176173207b36bf28514

SHA512
0b98ba7648398642441894a970d889d0d4769317531473def2decb847bdb9472b0b3671f96126ad7ad023d4a434cbcef8da7c8663df718dcf6ee3557874ad284

Download Submit
memory/1056-173-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-178-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1056-153-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-155-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-157-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-159-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-161-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-163-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-165-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-167-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-169-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-171-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-150-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-175-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-177-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-151-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/1056-179-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1056-180-0x0000000000400000-0x00000000006CC000-memory.dmp

Filesize
2.8MB

Download
memory/1056-181-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1056-182-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1056-183-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1056-186-0x0000000000400000-0x00000000006CC000-memory.dmp

Filesize
2.8MB

Download
memory/1056-149-0x0000000004C70000-0x0000000005214000-memory.dmp

Filesize
5.6MB

Download
memory/1056-148-0x00000000007C0000-0x00000000007ED000-memory.dmp

Filesize
180KB

Download
memory/3576-193-0x0000000000FA0000-0x0000000000FC8000-memory.dmp

Filesize
160KB

Download
memory/3576-194-0x0000000008240000-0x0000000008858000-memory.dmp

Filesize
6.1MB

Download
memory/3576-195-0x0000000007CD0000-0x0000000007CE2000-memory.dmp

Filesize
72KB

Download
memory/3576-196-0x0000000007E00000-0x0000000007F0A000-memory.dmp

Filesize
1.0MB

Download
memory/3576-197-0x0000000008090000-0x00000000080A0000-memory.dmp

Filesize
64KB

Download
memory/3576-198-0x0000000007D30000-0x0000000007D6C000-memory.dmp

Filesize
240KB

Download
memory/3576-199-0x0000000008090000-0x00000000080A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads