redline | 20e74bc79bfb0532144cf64baa086221b3a5af9c0da8725c2cc45d440977a5c0

General

Target

tmp.exe
Size

531KB
MD5

0787c11e305fb59655414af8d09ec63e
SHA1

50cc0591c756bb4481b406ca82599c8f7f54c259
SHA256

20e74bc79bfb0532144cf64baa086221b3a5af9c0da8725c2cc45d440977a5c0
SHA512

2d74f1a08ecf923353b233be58b74f441890b84223f9f82b55f781fb21e1aae6abf537bd2c3cb6bee0a22ab4e44fb26071a2e8072cfd1520100fcb0389f5bab2
SSDEEP

12288:lMr+y90FcFQdl2V+rOZoKH4dMZIpoGSfS09MbviKtzKw:ryiFkVJp4d5OGoODi2Kw

Score

10^/10

redline dubik evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dubik

C2

193.233.20.17:4139

Attributes

auth_value
05136deb26ad700ca57d43b1de454f46

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	rFY1449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	rFY1449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	rFY1449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	rFY1449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	rFY1449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	rFY1449.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1112	vJY8314.exe
2792	rFY1449.exe
656	tZw90wA.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	rFY1449.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vJY8314.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vJY8314.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	rFY1449.exe
2792	rFY1449.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	rFY1449.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1112	2972	tmp.exe	87
PID 2972 wrote to memory of 1112	2972	tmp.exe	87
PID 2972 wrote to memory of 1112	2972	tmp.exe	87
PID 1112 wrote to memory of 2792	1112	vJY8314.exe	88
PID 1112 wrote to memory of 2792	1112	vJY8314.exe	88
PID 1112 wrote to memory of 656	1112	vJY8314.exe	93
PID 1112 wrote to memory of 656	1112	vJY8314.exe	93
PID 1112 wrote to memory of 656	1112	vJY8314.exe	93

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJY8314.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJY8314.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rFY1449.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rFY1449.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tZw90wA.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tZw90wA.exe
    3⤵
    - Executes dropped EXE
    PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJY8314.exe

Filesize
202KB

MD5
f53a769d921d18436381a13221e4fb3f

SHA1
84186865f3e1d44e6bab7e05a8a924f2b7f216d7

SHA256
23ad9afac122f6494006dc58ca4ab0c70353532f23f52608a3d959ff21bcca89

SHA512
ef8e87f034a5e4eba8386ce66832450bb3f1fd9bfdd7de444ae8706d322546a23c19785a2349a514e11b9c4ca01b4f688dd54e4164224011c9297375c1e02043

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJY8314.exe

Filesize
202KB

MD5
f53a769d921d18436381a13221e4fb3f

SHA1
84186865f3e1d44e6bab7e05a8a924f2b7f216d7

SHA256
23ad9afac122f6494006dc58ca4ab0c70353532f23f52608a3d959ff21bcca89

SHA512
ef8e87f034a5e4eba8386ce66832450bb3f1fd9bfdd7de444ae8706d322546a23c19785a2349a514e11b9c4ca01b4f688dd54e4164224011c9297375c1e02043

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rFY1449.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rFY1449.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tZw90wA.exe

Filesize
175KB

MD5
cddbd387c5c8bb5e8a8ad341f7d05475

SHA1
1ae74b1a19a38a736b5321b41de10a48ab72eddc

SHA256
c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d

SHA512
ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tZw90wA.exe

Filesize
175KB

MD5
cddbd387c5c8bb5e8a8ad341f7d05475

SHA1
1ae74b1a19a38a736b5321b41de10a48ab72eddc

SHA256
c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d

SHA512
ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e

Download Submit
memory/656-152-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/656-153-0x0000000005CE0000-0x00000000062F8000-memory.dmp

Filesize
6.1MB

Download
memory/656-154-0x0000000005850000-0x000000000595A000-memory.dmp

Filesize
1.0MB

Download
memory/656-155-0x0000000005780000-0x0000000005792000-memory.dmp

Filesize
72KB

Download
memory/656-156-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/656-157-0x00000000057E0000-0x000000000581C000-memory.dmp

Filesize
240KB

Download
memory/656-158-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/2792-147-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads