redline | 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851

Analysis

max time kernel
146s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
Size

998KB
MD5

e117a2b9a45d4662173700af9f362061
SHA1

d9ed5a4fec5d1619768aa9a515076c5bb5a0526f
SHA256

00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851
SHA512

e5e5715955297d674b32b9939bdc93d73f5260896a8580894e5a7dfd65a2af1895b96b4744b8aa46c309dd8a410d037c3c507292622af13db02b52f8cb641117
SSDEEP

24576:UyUN+sJ9fZ45YsldeutPRU4CHc5yFl40:jE+Eb45YsjhtPA85

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3840-994-0x00000000078C0000-0x0000000007ED8000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	135164559.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	135164559.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	135164559.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	135164559.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	135164559.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	135164559.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2160	On089268.exe
4304	nL512125.exe
4864	135164559.exe
3840	217184863.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	135164559.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	135164559.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	On089268.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	On089268.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	nL512125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nL512125.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	135164559.exe
4864	135164559.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	135164559.exe
Token: SeDebugPrivilege	3840	217184863.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2160	4536	00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe	79
PID 4536 wrote to memory of 2160	4536	00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe	79
PID 4536 wrote to memory of 2160	4536	00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe	79
PID 2160 wrote to memory of 4304	2160	On089268.exe	80
PID 2160 wrote to memory of 4304	2160	On089268.exe	80
PID 2160 wrote to memory of 4304	2160	On089268.exe	80
PID 4304 wrote to memory of 4864	4304	nL512125.exe	82
PID 4304 wrote to memory of 4864	4304	nL512125.exe	82
PID 4304 wrote to memory of 4864	4304	nL512125.exe	82
PID 4304 wrote to memory of 3840	4304	nL512125.exe	85
PID 4304 wrote to memory of 3840	4304	nL512125.exe	85
PID 4304 wrote to memory of 3840	4304	nL512125.exe	85

C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
"C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

Filesize
769KB

MD5
86d4ee8201163b6593a72795161ab9c5

SHA1
4cded56f44b1b626451c908e50055d4b8c872537

SHA256
4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

SHA512
f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe

Filesize
769KB

MD5
86d4ee8201163b6593a72795161ab9c5

SHA1
4cded56f44b1b626451c908e50055d4b8c872537

SHA256
4cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1

SHA512
f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

Filesize
597KB

MD5
dabd1253e492dbec394f5fa5b17fa0a3

SHA1
8090fdca77797e2595e9d0988bf6d116a67634be

SHA256
32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

SHA512
b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe

Filesize
597KB

MD5
dabd1253e492dbec394f5fa5b17fa0a3

SHA1
8090fdca77797e2595e9d0988bf6d116a67634be

SHA256
32e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721

SHA512
b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

Filesize
390KB

MD5
4b120f5da98b13dce4a2f6b2c0e3d146

SHA1
4698a756543b0a1e16d6154a6b615b1ea12dc21e

SHA256
83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

SHA512
ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe

Filesize
390KB

MD5
4b120f5da98b13dce4a2f6b2c0e3d146

SHA1
4698a756543b0a1e16d6154a6b615b1ea12dc21e

SHA256
83edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff

SHA512
ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

Filesize
473KB

MD5
fda72bc28d66f7a712b27e768602b0b4

SHA1
77704544b3c1cf1fa1d62eb585ee69538d65a914

SHA256
5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

SHA512
cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe

Filesize
473KB

MD5
fda72bc28d66f7a712b27e768602b0b4

SHA1
77704544b3c1cf1fa1d62eb585ee69538d65a914

SHA256
5e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012

SHA512
cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8

Download Submit
memory/3840-229-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-219-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-997-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/3840-996-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/3840-995-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/3840-994-0x00000000078C0000-0x0000000007ED8000-memory.dmp

Filesize
6.1MB

Download
memory/3840-233-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-1000-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-235-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-231-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-207-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-227-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-225-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-221-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-223-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-998-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-220-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-218-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-216-0x00000000008F0000-0x0000000000936000-memory.dmp

Filesize
280KB

Download
memory/3840-215-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-213-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-211-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-209-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-1001-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-1002-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/3840-198-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-199-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-201-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-203-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/3840-205-0x0000000004E00000-0x0000000004E35000-memory.dmp

Filesize
212KB

Download
memory/4864-167-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-193-0x0000000000400000-0x0000000000807000-memory.dmp

Filesize
4.0MB

Download
memory/4864-191-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-190-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-189-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-188-0x0000000000400000-0x0000000000807000-memory.dmp

Filesize
4.0MB

Download
memory/4864-181-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-187-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-185-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-183-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-175-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-177-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-179-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-169-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-173-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-171-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-165-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-163-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-160-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-161-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/4864-159-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-158-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-156-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/4864-157-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4864-155-0x0000000004F60000-0x0000000005504000-memory.dmp

Filesize
5.6MB

Download