RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. C2 Connection – IP 198.46.86.63

Network analysis reveals that RedLine Stealer establishes a connection to the remote IP address 198.46.86.63. This IP is likely the malware's Command & Control (C2) server, used for data exfiltration and command delivery.

Key Observations:

• IP Address: 198.46.86.63
• Protocol: Likely HTTP/HTTPS (based on typical RedLine behavior).
• Purpose: C2 communication for stolen data (credentials, cookies, crypto wallets).

Why This Matters:

• C2 Infrastructure: The IP can be used to track the malware's origin.
• Detection: Network security tools can block this IP.
• Exfiltration: All stolen data is sent to this server.

Visual Reference:

Network monitor view showing RedLine Stealer connecting to 198.46.86.63.

2. Payload Memory Block – 7200 KB RW Region

Process Hacker reveals a large PAGE_READWRITE memory block (7200 KB) within the RedLine Stealer process. This region is marked as Private and contains the malware's payload, likely including stolen data, configuration, and executable code.

Key Observations:

• Size: 7200 KB (7.2 MB)
• Type: Private (not mapped from a file)
• Protection: PAGE_READWRITE (read/write, not executable)
• Purpose: Likely stores the main payload (data theft routines, C2 communication, etc.)

Why This Matters:

• Payload Storage: This block contains the core malicious code.
• Obfuscation: The data may be encrypted or compressed to evade detection.
• Memory Forensics: Dumping this region can reveal the full malware code.

Visual Reference:

Process Hacker view showing the 7200 KB PAGE_READWRITE memory block containing the payload.

3. Backup C2 – tempuri.org

Binary Ninja analysis reveals a second C2 server: tempuri.org. This likely serves as a backup or alternative C2 address in case the primary server (198.46.86.63) is unavailable.

Key Strings Observed:

• tempuri.org – Backup C2 server.
• Entity/Id9.Result – Endpoint for sending stolen data.
• Id9.Response – Endpoint for receiving C2 commands or acknowledgments.

Why This Matters:

• Redundancy: The backup C2 ensures data exfiltration continues even if the primary server is blocked.
• Exfiltration: Entity/Id9.Result is likely used to send stolen credentials, cookies, and crypto wallets.
• Detection: This domain can be blocked to disrupt the malware's communication.

Visual Reference:

Binary Ninja view showing tempuri.org as a backup C2 server with Entity/Id9.Result endpoint.

4. System Configuration & Persistence

Binary Ninja analysis reveals that RedLine Stealer collects system configuration settings and uses them for persistence and evasion.

Key Strings Observed:

• PSModulePath – PowerShell module path for command execution.
• HideExclusionsFromLocalAdmins – Hides Windows Defender exclusions.
• RemoteEncryptionProtectionMaxBlockTime – Controls encryption protection timing.
• LastMapsDisableHeartbeatReportTime – Heartbeat reporting for C2 communication.
• LastSetupErrorHeartbeatReportTime – Error reporting to C2.

Why This Matters:

• PowerShell Execution: The malware can run PowerShell scripts.
• Evasion: Hiding exclusions helps avoid antivirus detection.
• Persistence: Heartbeat reports indicate active C2 communication.

Visual Reference:

Binary Ninja view showing PowerShell path, Windows Defender settings, and heartbeat reports.

5. Windows Defender Exploit Guard Manipulation

Binary Ninja analysis reveals that RedLine Stealer manipulates multiple Windows Defender Exploit Guard settings to disable protection features and add exclusions.

Key Strings Observed:

• Windows Defender Exploit Guard\Network Protection – Disables network-based protection (e.g., blocking malicious IPs/domains).
• ASR\ASROnlyExclusions – Adds exclusions to Attack Surface Reduction (ASR) rules, preventing Defender from blocking specific files or processes.
• Controlled Folder Access – Modifies protected folder access, potentially bypassing ransomware protection.
• Windows Defender Exploit Guard\Controlled Folder Access\Allowed Applications – Adds the malware to the allowed applications list, allowing it to modify protected folders.
• Windows Defender Exploit Guard\Network Protection\Blocked URLs – Removes or modifies blocked URLs to allow C2 communication.
• Windows Defender Exploit Guard\ASR\Rules – Disables specific ASR rules that might detect the malware's behavior.

Why This Matters:

• Evasion: Disabling Network Protection and ASR rules helps the malware avoid detection.
• Persistence: Adding exclusions allows the malware to store files and modify system settings without being blocked.
• C2 Communication: Removing blocked URLs ensures the malware can connect to its C2 server without interruption.
• Ransomware Bypass: Modifying Controlled Folder Access helps avoid ransomware protection mechanisms.

Visual Reference:

Binary Ninja view showing multiple Windows Defender Exploit Guard strings.

Conclusion

This analysis uncovered RedLine Stealer, a .NET-based info-stealer that combines advanced evasion techniques, multiple C2 servers, and comprehensive data theft capabilities.

Key Takeaways:

• C2 Communication: Primary C2 at 198.46.86.63 and backup at tempuri.org.
• Payload Storage: 7200 KB PAGE_READWRITE memory block contains the main payload.
• Defender Bypass: Manipulates Windows Defender Exploit Guard settings (Network Protection, ASR, Controlled Folder Access).
• .NET Configuration: Uses standard .NET configuration sections for settings management.
• Data Theft: Steals credentials, cookies, crypto wallets, and system information.

Detection Recommendations:

• Block C2 domains: 198.46.86.63 and tempuri.org.
• Monitor for PAGE_READWRITE memory blocks larger than 5 MB in suspicious processes.
• Detect Windows Defender Exploit Guard registry modifications.
• Monitor for .NET configuration sections (System.Configuration) in unusual processes.

Sample Download

The analyzed RedLine Stealer sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 RedLine Stealer Sample on MalwareBazaar

Tools Used: Binary Ninja, Process Hacker, Network Monitor