redline | 2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b

Analysis

max time kernel
181s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe
Size

691KB
MD5

48f4221b6e1e25997f7dc3871a097590
SHA1

a36f8e4ca498e289c535c98a1b3ab8b47150fdaa
SHA256

2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b
SHA512

73161f743e1bd782b5dd075dd26739695d0f63da73a4afd7a011050e059664b5262df83b8361c0a00afe457ef0dd600a5f03f5444464602baa52d6edaa3f703f
SSDEEP

12288:7y90wGSYMZJis4AKb5x7htBv8M98e2C7CGjUANBlbLqt+78:7yXxnR4r7Dv9n2yAANDbutu8

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/1864-289-0x0000000007730000-0x0000000007D48000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	59351123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	59351123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	59351123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	59351123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	59351123.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	59351123.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
4044	un731860.exe
1472	59351123.exe
3048	rk289214.exe
4436	rk289214.exe
1864	si458083.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	59351123.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	59351123.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un731860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un731860.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 4436	3048	rk289214.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	1472	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	59351123.exe
1472	59351123.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	59351123.exe
Token: SeDebugPrivilege	4436	rk289214.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4044	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	84
PID 1152 wrote to memory of 4044	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	84
PID 1152 wrote to memory of 4044	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	84
PID 4044 wrote to memory of 1472	4044	un731860.exe	85
PID 4044 wrote to memory of 1472	4044	un731860.exe	85
PID 4044 wrote to memory of 1472	4044	un731860.exe	85
PID 4044 wrote to memory of 3048	4044	un731860.exe	88
PID 4044 wrote to memory of 3048	4044	un731860.exe	88
PID 4044 wrote to memory of 3048	4044	un731860.exe	88
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 3048 wrote to memory of 4436	3048	rk289214.exe	89
PID 1152 wrote to memory of 1864	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	90
PID 1152 wrote to memory of 1864	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	90
PID 1152 wrote to memory of 1864	1152	2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe	90

C:\Users\Admin\AppData\Local\Temp\2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe
"C:\Users\Admin\AppData\Local\Temp\2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731860.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731860.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\59351123.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\59351123.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1108
      4⤵
      Program crash
      PID:3452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458083.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458083.exe
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1472 -ip 1472
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458083.exe

Filesize
136KB

MD5
e1c805d3cefe221689da30b8a2d944f2

SHA1
a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

SHA256
32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

SHA512
7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si458083.exe

Filesize
136KB

MD5
e1c805d3cefe221689da30b8a2d944f2

SHA1
a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

SHA256
32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

SHA512
7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731860.exe

Filesize
537KB

MD5
3c7e73b315e28832126c96ecd089f59c

SHA1
2ebcec7168b64444165e7a530809f13923bbd88c

SHA256
04aa45a692115db68447d83eb66ae6fa19a0e153aadce41811ebbd41023e283c

SHA512
1e249ddb4f74dbed1d29d0865b3c0bbd69b03eca3476f54c8cf6f83d89bd128837ab56df65fc5178d6e19880a825112fef0a2e311a661a13665e1bcb73c80b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un731860.exe

Filesize
537KB

MD5
3c7e73b315e28832126c96ecd089f59c

SHA1
2ebcec7168b64444165e7a530809f13923bbd88c

SHA256
04aa45a692115db68447d83eb66ae6fa19a0e153aadce41811ebbd41023e283c

SHA512
1e249ddb4f74dbed1d29d0865b3c0bbd69b03eca3476f54c8cf6f83d89bd128837ab56df65fc5178d6e19880a825112fef0a2e311a661a13665e1bcb73c80b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\59351123.exe

Filesize
259KB

MD5
cf8befc29162ad3ea3539f88afebe980

SHA1
6558fe10689b5905cdcbd0189c4038c7a47c7a54

SHA256
d9b1a5772b7982836f85ba06d49fd1e91c12f8b6c2211ee870b4db18f858b803

SHA512
2886d3544eaee99ca01561519ab9b794bdc14f65244d66ea188bf23147acc4d66d06ba5b0e2a880fbf18565e6622cc679581f18d313b1c6d9b7a401c0816cf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\59351123.exe

Filesize
259KB

MD5
cf8befc29162ad3ea3539f88afebe980

SHA1
6558fe10689b5905cdcbd0189c4038c7a47c7a54

SHA256
d9b1a5772b7982836f85ba06d49fd1e91c12f8b6c2211ee870b4db18f858b803

SHA512
2886d3544eaee99ca01561519ab9b794bdc14f65244d66ea188bf23147acc4d66d06ba5b0e2a880fbf18565e6622cc679581f18d313b1c6d9b7a401c0816cf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe

Filesize
342KB

MD5
7ff2991942203a87f9fcd5bfe5a7478a

SHA1
7ceb5469ff8b01169ddb34fa4bdd01496674671b

SHA256
93731194e9fa0d849ff1f1eeb3f6211464b412a5def143f1c4c79f9cdf1cfe32

SHA512
b733e32b3039e7f38a0676da8e62d8763c53fdfbe59f9ea5eb2696550af9da24d8e99ad19239d759d11d733b4550df1991ce86fe501ed1278a140774ac1bb582

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe

Filesize
342KB

MD5
7ff2991942203a87f9fcd5bfe5a7478a

SHA1
7ceb5469ff8b01169ddb34fa4bdd01496674671b

SHA256
93731194e9fa0d849ff1f1eeb3f6211464b412a5def143f1c4c79f9cdf1cfe32

SHA512
b733e32b3039e7f38a0676da8e62d8763c53fdfbe59f9ea5eb2696550af9da24d8e99ad19239d759d11d733b4550df1991ce86fe501ed1278a140774ac1bb582

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk289214.exe

Filesize
342KB

MD5
7ff2991942203a87f9fcd5bfe5a7478a

SHA1
7ceb5469ff8b01169ddb34fa4bdd01496674671b

SHA256
93731194e9fa0d849ff1f1eeb3f6211464b412a5def143f1c4c79f9cdf1cfe32

SHA512
b733e32b3039e7f38a0676da8e62d8763c53fdfbe59f9ea5eb2696550af9da24d8e99ad19239d759d11d733b4550df1991ce86fe501ed1278a140774ac1bb582

Download Submit
memory/1472-153-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-181-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1472-156-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-158-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-160-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-162-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-164-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-166-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-168-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-172-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-174-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-170-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-178-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-180-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-176-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-154-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download
memory/1472-182-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/1472-184-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1472-148-0x00000000005C0000-0x00000000005ED000-memory.dmp

Filesize
180KB

Download
memory/1472-152-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/1472-149-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/1472-151-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/1472-150-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/1864-1005-0x00000000072B0000-0x00000000072C0000-memory.dmp

Filesize
64KB

Download
memory/1864-1008-0x00000000072B0000-0x00000000072C0000-memory.dmp

Filesize
64KB

Download
memory/1864-289-0x0000000007730000-0x0000000007D48000-memory.dmp

Filesize
6.1MB

Download
memory/1864-199-0x0000000000480000-0x00000000004A8000-memory.dmp

Filesize
160KB

Download
memory/1864-1003-0x0000000007210000-0x000000000724C000-memory.dmp

Filesize
240KB

Download
memory/1864-997-0x00000000071B0000-0x00000000071C2000-memory.dmp

Filesize
72KB

Download
memory/3048-192-0x0000000000600000-0x0000000000647000-memory.dmp

Filesize
284KB

Download
memory/4436-193-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4436-205-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-207-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-211-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-209-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-213-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-215-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-217-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-219-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-221-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-223-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-227-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-225-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-277-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4436-281-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-278-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-282-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-203-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-201-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-999-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-1000-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-1001-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-1002-0x0000000007B50000-0x0000000007C5A000-memory.dmp

Filesize
1.0MB

Download
memory/4436-200-0x0000000004980000-0x00000000049B5000-memory.dmp

Filesize
212KB

Download
memory/4436-1004-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-194-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4436-1007-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4436-190-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download