redline | 186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3

General

Target

186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe
Size

707KB
MD5

9156eaf25c6c3ca0e5a49ca9bd65d0c7
SHA1

23ae080dd25217ebdfd4b0a22a1909d0de717627
SHA256

186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3
SHA512

82182a974c7c74e46137bce133b79eb565b452b412750846b50b5a04c8800aff02bd648248bf09f50d110946fb7fd6b7e774479cc1d443ea54bdb976051701c3
SSDEEP

12288:YMrby90Y11sSjEtaF3mlVNxvaxauUdl8M2qKKNJ3Q+aO7lfRxUx+QUTZyQdFmtE:zyXsXtaF3v8diKNJ3Q+aO7lkhK+E1tbI

Score

10^/10

redline infostealer persistence stealer

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/3600-148-0x0000000007D20000-0x0000000008338000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
3036	x3605312.exe
3600	g2531431.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3605312.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3605312.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 3036	3956	186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe	79
PID 3956 wrote to memory of 3036	3956	186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe	79
PID 3956 wrote to memory of 3036	3956	186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe	79
PID 3036 wrote to memory of 3600	3036	x3605312.exe	80
PID 3036 wrote to memory of 3600	3036	x3605312.exe	80
PID 3036 wrote to memory of 3600	3036	x3605312.exe	80

C:\Users\Admin\AppData\Local\Temp\186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe
"C:\Users\Admin\AppData\Local\Temp\186cae0cdeb2d592ecd3a0a2816d3e73fe0ecd7dcf5e9a0ede45564c49be6ee3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3605312.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3605312.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2531431.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2531431.exe
    3⤵
    - Executes dropped EXE
    PID:3600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3605312.exe

Filesize
416KB

MD5
96d19575af620e32240c1efab687d559

SHA1
584c7f974cf52a9be9cb2e2c147b04d43124b07a

SHA256
457fc01d2e973bbef50576bdde9e3aec1729fbc2f752d980cede443a479a6610

SHA512
f36cf285155dc4e1b6667285efe19041ee1c46d44153caf2af9f922822bd44656536568742c6ed217890a27cd437461f25341cd50e9fc65897be2ca085ac5bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3605312.exe

Filesize
416KB

MD5
96d19575af620e32240c1efab687d559

SHA1
584c7f974cf52a9be9cb2e2c147b04d43124b07a

SHA256
457fc01d2e973bbef50576bdde9e3aec1729fbc2f752d980cede443a479a6610

SHA512
f36cf285155dc4e1b6667285efe19041ee1c46d44153caf2af9f922822bd44656536568742c6ed217890a27cd437461f25341cd50e9fc65897be2ca085ac5bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2531431.exe

Filesize
136KB

MD5
0a4c6372337cc1f5e4a2f6108d6a7940

SHA1
ba2500c1705f1b443056cba47d0e43ef443511ab

SHA256
2e5df50e455355089e68e0bd9b12afa7ec89b23f7901e7ba734415f12788cc26

SHA512
c8a02a9c8743f463936c5cce85871dde9bec452fa3c7ff1a54ba39419482ac6a6d75f4370acf76d0becc2da3fda2f9e8be3788651823d09482658c0f3e3b5d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2531431.exe

Filesize
136KB

MD5
0a4c6372337cc1f5e4a2f6108d6a7940

SHA1
ba2500c1705f1b443056cba47d0e43ef443511ab

SHA256
2e5df50e455355089e68e0bd9b12afa7ec89b23f7901e7ba734415f12788cc26

SHA512
c8a02a9c8743f463936c5cce85871dde9bec452fa3c7ff1a54ba39419482ac6a6d75f4370acf76d0becc2da3fda2f9e8be3788651823d09482658c0f3e3b5d0f

Download Submit
memory/3600-147-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download
memory/3600-148-0x0000000007D20000-0x0000000008338000-memory.dmp

Filesize
6.1MB

Download
memory/3600-149-0x0000000007770000-0x0000000007782000-memory.dmp

Filesize
72KB

Download
memory/3600-150-0x00000000078A0000-0x00000000079AA000-memory.dmp

Filesize
1.0MB

Download
memory/3600-151-0x0000000007810000-0x000000000784C000-memory.dmp

Filesize
240KB

Download
memory/3600-152-0x0000000007880000-0x0000000007890000-memory.dmp

Filesize
64KB

Download
memory/3600-153-0x0000000007880000-0x0000000007890000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing