redline | 3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd

General

Target

3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe
Size

600KB
MD5

884f9204bd0ca4dcfea1692c7ba6ce5a
SHA1

4369f34537f9e2921d90a0244dfaa7b22a06d156
SHA256

3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd
SHA512

6788bd2542799099c441d0cf46d2bca904fba2cd462e90198efd271e6e9d240a78bf7be4fe6ad3ad74deaa1204b8909175156aa3be04a07c4d9ade6cc89924bd
SSDEEP

12288:OMrSy90rGmTP0m+SAoHoMp+uCaeSriYBzee5jwGL1QSSO+3voHg:QySRwOAoHfTbrigzj1LXZaoHg

Score

10^/10

redline infostealer persistence stealer

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4408-148-0x0000000008230000-0x0000000008848000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4956	y9588459.exe
4408	k7715634.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9588459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9588459.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4956	5036	3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe	82
PID 5036 wrote to memory of 4956	5036	3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe	82
PID 5036 wrote to memory of 4956	5036	3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe	82
PID 4956 wrote to memory of 4408	4956	y9588459.exe	83
PID 4956 wrote to memory of 4408	4956	y9588459.exe	83
PID 4956 wrote to memory of 4408	4956	y9588459.exe	83

C:\Users\Admin\AppData\Local\Temp\3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe
"C:\Users\Admin\AppData\Local\Temp\3549c1e964e1072f587f2a942702973b1994fa133122fdb80d6ec105002873cd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9588459.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9588459.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7715634.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7715634.exe
    3⤵
    - Executes dropped EXE
    PID:4408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9588459.exe

Filesize
308KB

MD5
aec77c5aa47d8068d195f78018188790

SHA1
0d27d09b6acd8cbfea11b9e1a6250b82e5eb582a

SHA256
d61036360ac289b1446ebc53ffa325087d9c97e921e86f42fd3b2db8df2d4683

SHA512
6c3ea6371e0bb5618b21f1af4e94d0ee726f16849e2bba99f83fa413296a127495df6374df11d9db04bed59fb1e42f4c3afc1e65c3dbca8be0562b708a768be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9588459.exe

Filesize
308KB

MD5
aec77c5aa47d8068d195f78018188790

SHA1
0d27d09b6acd8cbfea11b9e1a6250b82e5eb582a

SHA256
d61036360ac289b1446ebc53ffa325087d9c97e921e86f42fd3b2db8df2d4683

SHA512
6c3ea6371e0bb5618b21f1af4e94d0ee726f16849e2bba99f83fa413296a127495df6374df11d9db04bed59fb1e42f4c3afc1e65c3dbca8be0562b708a768be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7715634.exe

Filesize
136KB

MD5
81d1d3d9df6a018d333bc02328e29e8f

SHA1
5e793a8ae5cf94dca0af8b3e1a1ef4cfa647c6d8

SHA256
d6ad7ae7920a4334b0a83ad8d4305556eef29f7416dee2a9e1f49747ba52e734

SHA512
f108b85c535ba06c7b2aad648048ce75af43d519bbde287187b4f5e767459e743aacc0f4afeda6ce6afdf9e704248e680cbaf64c2f05585562724e86f539c8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7715634.exe

Filesize
136KB

MD5
81d1d3d9df6a018d333bc02328e29e8f

SHA1
5e793a8ae5cf94dca0af8b3e1a1ef4cfa647c6d8

SHA256
d6ad7ae7920a4334b0a83ad8d4305556eef29f7416dee2a9e1f49747ba52e734

SHA512
f108b85c535ba06c7b2aad648048ce75af43d519bbde287187b4f5e767459e743aacc0f4afeda6ce6afdf9e704248e680cbaf64c2f05585562724e86f539c8af

Download Submit
memory/4408-147-0x0000000000FC0000-0x0000000000FE8000-memory.dmp

Filesize
160KB

Download
memory/4408-148-0x0000000008230000-0x0000000008848000-memory.dmp

Filesize
6.1MB

Download
memory/4408-149-0x0000000007CD0000-0x0000000007CE2000-memory.dmp

Filesize
72KB

Download
memory/4408-150-0x0000000007E00000-0x0000000007F0A000-memory.dmp

Filesize
1.0MB

Download
memory/4408-151-0x0000000007D70000-0x0000000007DAC000-memory.dmp

Filesize
240KB

Download
memory/4408-152-0x0000000007D60000-0x0000000007D70000-memory.dmp

Filesize
64KB

Download
memory/4408-153-0x0000000007D60000-0x0000000007D70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing