redline | 00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c

General

Target

00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe
Size

562KB
MD5

fd52fc7ea3c250f84819c4c141dc8741
SHA1

d650d1ce1216a573a7084a02313e670d0c43c7fc
SHA256

00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c
SHA512

e2617fa8b4bab1f27da7ea3f63ea319bf27480c59216d7c0fce41227d92bb67b893f5b6004e31bbee4954817279d4dcfc5609cfc5a4797e160e837f54db7141a
SSDEEP

12288:9Mriy90RbphHar+91hNPsXKUvNyR2PPgtgDm:Hyabph6691TPsX5NqqPgtg6

Score

10^/10

redline fud evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

sf53oN22uD70.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sf53oN22uD70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sf53oN22uD70.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sf53oN22uD70.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sf53oN22uD70.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sf53oN22uD70.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sf53oN22uD70.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2968-157-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-158-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-160-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-162-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-164-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-166-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-168-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-170-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-172-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-174-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-176-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-178-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-180-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-182-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-184-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-186-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-188-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-190-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-192-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-194-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-196-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-198-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-200-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-202-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-204-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-206-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-208-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-210-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-212-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-214-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-216-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-218-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline
behavioral2/memory/2968-220-0x00000000072D0000-0x000000000730E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

vhWy5170Gp.exesf53oN22uD70.exetf04OK62xf42.exe

pid process

4860 vhWy5170Gp.exe
3976 sf53oN22uD70.exe
2968 tf04OK62xf42.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

sf53oN22uD70.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf53oN22uD70.exe

pid	process
4860	vhWy5170Gp.exe
3976	sf53oN22uD70.exe
2968	tf04OK62xf42.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sf53oN22uD70.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exevhWy5170Gp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vhWy5170Gp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vhWy5170Gp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

sf53oN22uD70.exe

pid process

3976 sf53oN22uD70.exe
3976 sf53oN22uD70.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

sf53oN22uD70.exetf04OK62xf42.exe

description pid process

Token: SeDebugPrivilege 3976 sf53oN22uD70.exe
Token: SeDebugPrivilege 2968 tf04OK62xf42.exe

pid	process
3976	sf53oN22uD70.exe
3976	sf53oN22uD70.exe

description	pid	process
Token: SeDebugPrivilege	3976	sf53oN22uD70.exe
Token: SeDebugPrivilege	2968	tf04OK62xf42.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exevhWy5170Gp.exe

description	pid	process	target process
PID 3504 wrote to memory of 4860	3504	00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe	vhWy5170Gp.exe
PID 3504 wrote to memory of 4860	3504	00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe	vhWy5170Gp.exe
PID 3504 wrote to memory of 4860	3504	00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe	vhWy5170Gp.exe
PID 4860 wrote to memory of 3976	4860	vhWy5170Gp.exe	sf53oN22uD70.exe
PID 4860 wrote to memory of 3976	4860	vhWy5170Gp.exe	sf53oN22uD70.exe
PID 4860 wrote to memory of 2968	4860	vhWy5170Gp.exe	tf04OK62xf42.exe
PID 4860 wrote to memory of 2968	4860	vhWy5170Gp.exe	tf04OK62xf42.exe
PID 4860 wrote to memory of 2968	4860	vhWy5170Gp.exe	tf04OK62xf42.exe

C:\Users\Admin\AppData\Local\Temp\00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe
"C:\Users\Admin\AppData\Local\Temp\00b60a149b0bd800b2156e7391e1b5cec4e5ed3a2cf0a30cae79896c5a27342c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWy5170Gp.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWy5170Gp.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4860

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf53oN22uD70.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf53oN22uD70.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf04OK62xf42.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf04OK62xf42.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWy5170Gp.exe
Filesize
418KB

MD5
346ec8e850c50dd86405cd383a0ec2ec

SHA1
8eaf4a3f3f9d327ab0be7243c081c382e2f907b0

SHA256
8bdfbc6c9d3c31c9f062b2cac5b6a79f92acf0c2b9e068431ef15bf70377a713

SHA512
94f99d9df3da78c4dbe70587edb2013e458b2f1014d440efe6e94bad59f328cfcb9964a0123cb9ac2bbe8c07a34f6d184cc9aba8de9b8bc3f1f63d5a5cdaeb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWy5170Gp.exe
Filesize
418KB

MD5
346ec8e850c50dd86405cd383a0ec2ec

SHA1
8eaf4a3f3f9d327ab0be7243c081c382e2f907b0

SHA256
8bdfbc6c9d3c31c9f062b2cac5b6a79f92acf0c2b9e068431ef15bf70377a713

SHA512
94f99d9df3da78c4dbe70587edb2013e458b2f1014d440efe6e94bad59f328cfcb9964a0123cb9ac2bbe8c07a34f6d184cc9aba8de9b8bc3f1f63d5a5cdaeb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf53oN22uD70.exe
Filesize
11KB

MD5
57c7acf24e7608e2d2fc6152f0a65adf

SHA1
68f3bd411dd5c1c04c0affd838ea42745412bfe7

SHA256
a1c7c125d15a36bd3ebb6dcf0055d031c1072e4fbef582142f1b4ed9d64dd984

SHA512
44031547e6355310c657c30467c49fc9d2762a9e4531a4dba5cabc1f9a576ae09c8085cf63759a6ffbe96c28cd525eb08149143c2585932417a2237b37cbd064

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf53oN22uD70.exe
Filesize
11KB

MD5
57c7acf24e7608e2d2fc6152f0a65adf

SHA1
68f3bd411dd5c1c04c0affd838ea42745412bfe7

SHA256
a1c7c125d15a36bd3ebb6dcf0055d031c1072e4fbef582142f1b4ed9d64dd984

SHA512
44031547e6355310c657c30467c49fc9d2762a9e4531a4dba5cabc1f9a576ae09c8085cf63759a6ffbe96c28cd525eb08149143c2585932417a2237b37cbd064

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf04OK62xf42.exe
Filesize
420KB

MD5
26c4ff23e7d77f037b4cf034354d85b2

SHA1
c6596b283bc440832c9baf35453ebc4d9fb70115

SHA256
61a27dc04dc6709f1cd05c3b9bd7bae777e915f524decb5948c8cb8f26ff2b19

SHA512
c2befc78aa793989b2838803971cd9675a35c1c657a127a69f4bbbd852b77f79df2d733b934d1411b07fe7f01f75359749382be7e8b0c6c9d2b582a5423fc1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf04OK62xf42.exe
Filesize
420KB

MD5
26c4ff23e7d77f037b4cf034354d85b2

SHA1
c6596b283bc440832c9baf35453ebc4d9fb70115

SHA256
61a27dc04dc6709f1cd05c3b9bd7bae777e915f524decb5948c8cb8f26ff2b19

SHA512
c2befc78aa793989b2838803971cd9675a35c1c657a127a69f4bbbd852b77f79df2d733b934d1411b07fe7f01f75359749382be7e8b0c6c9d2b582a5423fc1f9

Download Submit
memory/2968-153-0x0000000007340000-0x00000000078E4000-memory.dmp

Filesize
5.6MB

Download
memory/2968-154-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/2968-155-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2968-156-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2968-157-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-158-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-160-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-162-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-164-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-166-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-168-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-170-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-172-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-174-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-176-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-178-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-180-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-182-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-184-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-186-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-188-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-190-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-192-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-194-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-196-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-198-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-200-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-202-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-204-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-206-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-208-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-210-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-212-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-214-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-216-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-218-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-220-0x00000000072D0000-0x000000000730E000-memory.dmp

Filesize
248KB

Download
memory/2968-1063-0x0000000007920000-0x0000000007F38000-memory.dmp

Filesize
6.1MB

Download
memory/2968-1064-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/2968-1065-0x0000000008100000-0x0000000008112000-memory.dmp

Filesize
72KB

Download
memory/2968-1066-0x0000000008120000-0x000000000815C000-memory.dmp

Filesize
240KB

Download
memory/2968-1067-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2968-1069-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2968-1070-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/2968-1071-0x0000000007330000-0x0000000007340000-memory.dmp

Filesize
64KB

Download
memory/3976-147-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads