redline | 39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb

Analysis

max time kernel
153s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe
Size

747KB
MD5

8dd5da27707c53b6acf8484d46dd4d92
SHA1

6ed443bd9a356033531cb51d10e4bcc28763a06f
SHA256

39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb
SHA512

aad2f44870ef31f528fff29f386a8ce4ae80b50621f5568b20d1ad4f27a88cca9a7eabf5860f5ec9dfec38e2347330b632eb9994768759e06657ea9f46f43850
SSDEEP

12288:hy90Hh6UtNuE8UtcKmHwGvvyrUGayqmG+MBYaTqbL4wr2fLCo7HPxsc:hyu48oakQGCrfapYaGbLZseC7

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3448-988-0x00000000078F0000-0x0000000007F08000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	41690106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	41690106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	41690106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	41690106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	41690106.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	41690106.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3560	un295215.exe
4792	41690106.exe
3448	rk973565.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	41690106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	41690106.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un295215.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un295215.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5BCB44EF-54C2-43B5-B66B-721C6CCAA482}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FC7CE0E7-B1B0-4D76-8104-6892EDE8C96F}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	41690106.exe
4792	41690106.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	41690106.exe
Token: SeDebugPrivilege	3448	rk973565.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3560	4444	39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe	82
PID 4444 wrote to memory of 3560	4444	39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe	82
PID 4444 wrote to memory of 3560	4444	39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe	82
PID 3560 wrote to memory of 4792	3560	un295215.exe	83
PID 3560 wrote to memory of 4792	3560	un295215.exe	83
PID 3560 wrote to memory of 4792	3560	un295215.exe	83
PID 3560 wrote to memory of 3448	3560	un295215.exe	86
PID 3560 wrote to memory of 3448	3560	un295215.exe	86
PID 3560 wrote to memory of 3448	3560	un295215.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe
"C:\Users\Admin\AppData\Local\Temp\39755ae8c632c5b46f0a5f1ed5c40508d13594889387e246302f3ef6576552cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un295215.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un295215.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41690106.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41690106.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk973565.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk973565.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un295215.exe

Filesize
593KB

MD5
3ce352927ea202aa6dcf98ba784f41a5

SHA1
36b7014a702f5f2bf12824503f60440a407f65a7

SHA256
d31c7f72aec8e294d6c1438d3d84740b467ad114c82847338f59b4d2483ee37b

SHA512
b3ae38d89d90682d44add2058e0a6a79beb1abb6983911bc3956dd8cbb66f9774951199434d6b80471af4705b8f4e17179449c4cf29eb245beef0c0e6f82f58d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un295215.exe

Filesize
593KB

MD5
3ce352927ea202aa6dcf98ba784f41a5

SHA1
36b7014a702f5f2bf12824503f60440a407f65a7

SHA256
d31c7f72aec8e294d6c1438d3d84740b467ad114c82847338f59b4d2483ee37b

SHA512
b3ae38d89d90682d44add2058e0a6a79beb1abb6983911bc3956dd8cbb66f9774951199434d6b80471af4705b8f4e17179449c4cf29eb245beef0c0e6f82f58d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41690106.exe

Filesize
377KB

MD5
8a7efdcc89765019e90a2d9589b178fa

SHA1
decc7fdb89c1a1fe43e9ec1162c3e6d677073f84

SHA256
053651850faf52d04b1d1a97f85467bdc6ef2ade256ac772027fe9e38c9a097d

SHA512
77b03127a0ddaac8d7691fd291aa9342d1d741412b8d388f52d6845a5cc9c15fa80d89d659d93b11274e0d448a1acac89b688ce6384ec00db197a161640ad224

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41690106.exe

Filesize
377KB

MD5
8a7efdcc89765019e90a2d9589b178fa

SHA1
decc7fdb89c1a1fe43e9ec1162c3e6d677073f84

SHA256
053651850faf52d04b1d1a97f85467bdc6ef2ade256ac772027fe9e38c9a097d

SHA512
77b03127a0ddaac8d7691fd291aa9342d1d741412b8d388f52d6845a5cc9c15fa80d89d659d93b11274e0d448a1acac89b688ce6384ec00db197a161640ad224

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk973565.exe

Filesize
459KB

MD5
388ee03e27f4533505002b9374ba9db4

SHA1
2d16cd8e276b7c65e351bc77e36342682c689de0

SHA256
3a8a50052cbdaf62a62bf66d7f8346b50a92234f95d6f6a6bc3537ed70879a97

SHA512
fc52581a21e5cec95eacc13ada46a68649440b3c409ef587e29c97154d1615d1a66ec8fd357ef2a046f7365603e78c4195282bbae9b39e13a461826c8466a29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk973565.exe

Filesize
459KB

MD5
388ee03e27f4533505002b9374ba9db4

SHA1
2d16cd8e276b7c65e351bc77e36342682c689de0

SHA256
3a8a50052cbdaf62a62bf66d7f8346b50a92234f95d6f6a6bc3537ed70879a97

SHA512
fc52581a21e5cec95eacc13ada46a68649440b3c409ef587e29c97154d1615d1a66ec8fd357ef2a046f7365603e78c4195282bbae9b39e13a461826c8466a29f

Download Submit
memory/3448-217-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-225-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-1003-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-996-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-995-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-994-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-992-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/3448-198-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-991-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-990-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/3448-989-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/3448-196-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-229-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-227-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-194-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-202-0x0000000000820000-0x0000000000866000-memory.dmp

Filesize
280KB

Download
memory/3448-223-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-221-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-219-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-215-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-213-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-211-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-209-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-207-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-206-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-193-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-204-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3448-988-0x00000000078F0000-0x0000000007F08000-memory.dmp

Filesize
6.1MB

Download
memory/3448-203-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/3448-200-0x00000000053F0000-0x0000000005425000-memory.dmp

Filesize
212KB

Download
memory/4792-176-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-162-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-153-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-151-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-152-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-188-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4792-186-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-185-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-184-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4792-150-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/4792-183-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4792-182-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-180-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-178-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-174-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-172-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-170-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-168-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-166-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-164-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-160-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-158-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-156-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-155-0x00000000026E0000-0x00000000026F2000-memory.dmp

Filesize
72KB

Download
memory/4792-154-0x0000000004DC0000-0x0000000005364000-memory.dmp

Filesize
5.6MB

Download