Sarah Chen — Malware Reverse Engineer
Key Takeaways
- RedLine Stealer employs phishing and malicious payloads for initial access.
- The malware showcases advanced evasion techniques and a robust command and control infrastructure.
- Indicators of compromise (IOCs) include specific file names and registry modifications associated with the RedLine Stealer variant.
Executive Summary
During our investigation of a recent campaign utilizing RedLine Stealer, we observed a systematic approach to data theft, leveraging social engineering tactics and sophisticated evasion methods. This campaign demonstrates the actor’s ability to adapt to detection mechanisms and exploit various vulnerabilities across targeted environments. In this post, we will dissect the entire attack chain, from initial access techniques to the actor’s final objectives, while mapping the attack to the MITRE ATT&CK framework.
Initial Access
The initial access vector observed in this campaign primarily involved phishing emails containing malicious links leading to file downloads. The actor utilized expertly crafted emails that mimicked legitimate sources, enticing victims to download a ZIP file. Upon extraction, the payload, named setup.exe, executed a PowerShell command to download additional malicious components from a remote server, establishing a foothold within the target environment.
Execution & Persistence
Our analysis revealed that the payload executed by the RedLine Stealer employed the execute-assembly method to run. Once executed, the malware dropped several files in the %APPDATA%\Local\Temp directory, configuring itself to run at startup. Specifically, the actor created a registry key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with a value pointing to the executable to maintain persistence across reboots. This registry manipulation is a common method to ensure the implant remains active.
Command and Control
The command and control (C2) communication employed by RedLine Stealer was a critical aspect of our investigation. The malware established a connection to multiple domain names, dynamically generated for evasion purposes. We observed encrypted HTTP requests targeting these domains, which allowed the actor to control compromised machines remotely and retrieve sensitive information. Additionally, the use of a seemingly legitimate domain name obfuscated the true nature of the traffic, complicating detection efforts on both the network and host levels.
Lateral Movement & Discovery
As part of the attack chain, lateral movement capabilities were integrated into the RedLine Stealer variant. During our research, we noted the malware’s ability to execute commands remotely using Windows Management Instrumentation (WMI) and PsExec. By leveraging T1090 – Connection Proxy, the actor sought to escalate privileges and gain deeper network access, allowing for extensive data exfiltration. Our findings included instances of enumerating network shares and user accounts, indicative of the actor’s intent to pivot within the network for maximum data theft.
Impact & Objectives
The RedLine Stealer campaign’s objective was unequivocally focused on financial gain through the harvesting of credentials and sensitive information from infected systems. This included usernames, passwords, and data entered into web forms. The actor marketed this stolen data on various illicit forums, presenting it as a commodity for further exploitation. Additionally, we noted that the malware could facilitate further attacks by maintaining a persistent presence, thus increasing the potential for additional lateral movements across compromised networks.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access via phishing emails with malicious attachments.
- T1059.001 – PowerShell: Execution of commands through PowerShell during the malware execution phase.
- T1071.001 – Application Layer Protocol: Web Protocols: Use of HTTP for communication with the C2 server.
- T1086 – PowerShell: Execution of PowerShell scripts for lateral movement and command execution.
Detection Opportunities
- Monitor for unusual registry modifications in the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runkey. - Anomaly detection on outbound HTTP traffic can reveal communication with known malicious domains and IPs.
- Implement endpoint detection and response (EDR) solutions to monitor for PowerShell activity and suspicious command executions.
Analyst Notes
Throughout our investigation, it became clear that the RedLine Stealer campaign highlights the continuous evolution of threat actor techniques and tactics. Adaptability in their methods poses persistent challenges for defenders. Organizations must employ comprehensive security training to recognize phishing attempts and utilize advanced detection capabilities to monitor for variants of known malware like RedLine. Furthermore, proactive measures such as patching vulnerabilities and implementing least privilege access can significantly reduce the impact of such incidents.
Source: Original Report