redline | 02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/03/2023, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe
Size

600KB
MD5

3e0bc3bf6087599120095c83924b10eb
SHA1

ebd68b578b7ef26ca23e926eb5d7a9ef9107170d
SHA256

02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0
SHA512

302d0003eca62962a0a184fab437517c01cf0f9640314010b20c279686f6d24f9a0a0f48a52368d8835a7468a13669e624c1cac49624be93a61fa6bab7a3157f
SSDEEP

12288:yiqMFqi1VrEpCotyUk0RcdKTNF7rUIjXwY1HrKSSU/i:ySqi13otyyReOLVjXwYCr

Score

10^/10

redline redko evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

redko

62.204.41.170:4179

Attributes

auth_value
9bcf7b0620ff067017d66b9a5d80b547

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	loda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	loda.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1288	hook.exe
580	loda.exe
1112	redko.exe

Loads dropped DLL 5 IoCs

pid	Process
1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe
1288	hook.exe
1288	hook.exe
1288	hook.exe
1112	redko.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	loda.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hook.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
580	loda.exe
580	loda.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	loda.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1448 wrote to memory of 1288	1448	02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe	27
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 580	1288	hook.exe	28
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29
PID 1288 wrote to memory of 1112	1288	hook.exe	29

C:\Users\Admin\AppData\Local\Temp\02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe
"C:\Users\Admin\AppData\Local\Temp\02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe

Filesize
192KB

MD5
cd804ba80f2ec30311965af7071eb96a

SHA1
d2256177e0e934624e0821a86c9aeffb075607e9

SHA256
cabfabebf356f52925d5b5aa2a50e4979e020db5cca00f3e36c94aacff53fe8d

SHA512
bce8b566fac667133a8ffc1c4be5dd6ea4eaa7ec9de8a3127b589606902476f974fcf6e9db331e3768d301b64234fac26a2e83fbbd1eaf3846495dc6f76da608

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe

Filesize
192KB

MD5
cd804ba80f2ec30311965af7071eb96a

SHA1
d2256177e0e934624e0821a86c9aeffb075607e9

SHA256
cabfabebf356f52925d5b5aa2a50e4979e020db5cca00f3e36c94aacff53fe8d

SHA512
bce8b566fac667133a8ffc1c4be5dd6ea4eaa7ec9de8a3127b589606902476f974fcf6e9db331e3768d301b64234fac26a2e83fbbd1eaf3846495dc6f76da608

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe

Filesize
175KB

MD5
bc928465d24e037fb2009bd5668c80f5

SHA1
3ac1119fe355f2dae8d78bbe867c0cd24b9564a2

SHA256
1ab89ee322d5eb379129abd500726a8d709899b44f12825457902d360810f38c

SHA512
951621178d8e0f63daea8e725d1e19968b7da3714b66f82a6ab6ef075a7b1fbb295b92efa9e57f06b6e5dda126c5e5927fb190fde0944c5a55ed69e98ee2cfe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe

Filesize
175KB

MD5
bc928465d24e037fb2009bd5668c80f5

SHA1
3ac1119fe355f2dae8d78bbe867c0cd24b9564a2

SHA256
1ab89ee322d5eb379129abd500726a8d709899b44f12825457902d360810f38c

SHA512
951621178d8e0f63daea8e725d1e19968b7da3714b66f82a6ab6ef075a7b1fbb295b92efa9e57f06b6e5dda126c5e5927fb190fde0944c5a55ed69e98ee2cfe6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe

Filesize
192KB

MD5
cd804ba80f2ec30311965af7071eb96a

SHA1
d2256177e0e934624e0821a86c9aeffb075607e9

SHA256
cabfabebf356f52925d5b5aa2a50e4979e020db5cca00f3e36c94aacff53fe8d

SHA512
bce8b566fac667133a8ffc1c4be5dd6ea4eaa7ec9de8a3127b589606902476f974fcf6e9db331e3768d301b64234fac26a2e83fbbd1eaf3846495dc6f76da608

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe

Filesize
192KB

MD5
cd804ba80f2ec30311965af7071eb96a

SHA1
d2256177e0e934624e0821a86c9aeffb075607e9

SHA256
cabfabebf356f52925d5b5aa2a50e4979e020db5cca00f3e36c94aacff53fe8d

SHA512
bce8b566fac667133a8ffc1c4be5dd6ea4eaa7ec9de8a3127b589606902476f974fcf6e9db331e3768d301b64234fac26a2e83fbbd1eaf3846495dc6f76da608

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe

Filesize
175KB

MD5
bc928465d24e037fb2009bd5668c80f5

SHA1
3ac1119fe355f2dae8d78bbe867c0cd24b9564a2

SHA256
1ab89ee322d5eb379129abd500726a8d709899b44f12825457902d360810f38c

SHA512
951621178d8e0f63daea8e725d1e19968b7da3714b66f82a6ab6ef075a7b1fbb295b92efa9e57f06b6e5dda126c5e5927fb190fde0944c5a55ed69e98ee2cfe6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe

Filesize
175KB

MD5
bc928465d24e037fb2009bd5668c80f5

SHA1
3ac1119fe355f2dae8d78bbe867c0cd24b9564a2

SHA256
1ab89ee322d5eb379129abd500726a8d709899b44f12825457902d360810f38c

SHA512
951621178d8e0f63daea8e725d1e19968b7da3714b66f82a6ab6ef075a7b1fbb295b92efa9e57f06b6e5dda126c5e5927fb190fde0944c5a55ed69e98ee2cfe6

Download Submit
memory/580-73-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1112-82-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/1112-83-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download
memory/1112-86-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download
memory/1448-75-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1448-74-0x0000000000300000-0x000000000036C000-memory.dmp

Filesize
432KB

Download