redline | 59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe
Size

700KB
MD5

99dad01b0bd324321b0a3d0703b5a0e4
SHA1

09298efdb1f736b0c1adef3dc6b8ba037b1fd146
SHA256

59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d
SHA512

f012b4f82f08106e64a5b2a76f567d82d3d9cf0b65a0cd1f725a5c9f20bdfcdd2ca86529381b40ae45ea4c3164d08b04c390c94e05ca794a9431c0d2f1bf2354
SSDEEP

12288:JMr5y90cZ3SIA9RX6Cpud+FUpZjSCpKYXl+Eu3uXGDodBRvyrMGWVhtl7:AyRCIA7X68QO6B3DVtGDod+rCH7

Score

10^/10

redline sony evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2788.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral1/memory/4392-192-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-191-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-194-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-196-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-198-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-200-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-202-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-209-0x0000000002780000-0x0000000002790000-memory.dmp	family_redline
behavioral1/memory/4392-210-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-212-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-205-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-214-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-216-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-218-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-220-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-222-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-224-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-226-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline
behavioral1/memory/4392-228-0x00000000052A0000-0x00000000052DE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2376	un561695.exe
2116	pro2788.exe
4392	qu9703.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2788.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un561695.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un561695.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
648	2116	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	pro2788.exe
2116	pro2788.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	pro2788.exe
Token: SeDebugPrivilege	4392	qu9703.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2376	4124	59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe	85
PID 4124 wrote to memory of 2376	4124	59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe	85
PID 4124 wrote to memory of 2376	4124	59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe	85
PID 2376 wrote to memory of 2116	2376	un561695.exe	86
PID 2376 wrote to memory of 2116	2376	un561695.exe	86
PID 2376 wrote to memory of 2116	2376	un561695.exe	86
PID 2376 wrote to memory of 4392	2376	un561695.exe	92
PID 2376 wrote to memory of 4392	2376	un561695.exe	92
PID 2376 wrote to memory of 4392	2376	un561695.exe	92

C:\Users\Admin\AppData\Local\Temp\59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe
"C:\Users\Admin\AppData\Local\Temp\59d63b343e8bf5ab473d81e4be90a05917cd5170140ce4384196a3834977994d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un561695.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un561695.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2788.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2788.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1084
      4⤵
      Program crash
      PID:648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9703.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2116 -ip 2116
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un561695.exe

Filesize
558KB

MD5
f4d5ed4dd5dec4d282cf0c038e6d145b

SHA1
8d78e0378ee3fd485cfde1829cb52f28f942b302

SHA256
a2ff79f31deafd7da7e9fd99abc0c837f1938c71da15a4cd4213104aa81906d3

SHA512
70ccc1b31087e5b7ef75c8dd3f2001c88e9c3fe1bdcbc20d8fb88bd9e5192fd40cda07c0e9d34e0246602b9f7dbe0eeccbd9f41d6a577276430c284d5c2bb264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un561695.exe

Filesize
558KB

MD5
f4d5ed4dd5dec4d282cf0c038e6d145b

SHA1
8d78e0378ee3fd485cfde1829cb52f28f942b302

SHA256
a2ff79f31deafd7da7e9fd99abc0c837f1938c71da15a4cd4213104aa81906d3

SHA512
70ccc1b31087e5b7ef75c8dd3f2001c88e9c3fe1bdcbc20d8fb88bd9e5192fd40cda07c0e9d34e0246602b9f7dbe0eeccbd9f41d6a577276430c284d5c2bb264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2788.exe

Filesize
308KB

MD5
57cd27197396bb1efaefd85c129de708

SHA1
46493512f479e688d7b75249f308aea290ef5975

SHA256
7d7b13e6cc503a379ab9874d67f791f57dea7a108431b71d04db8efe3abd6b76

SHA512
9b26675486d69945efdfbbdbce3f158117ce35a496c9f68537e99765f79b002e530b9a769f22a7282661a4085b50089d2458256d9728f9cc58505f8276ffcaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2788.exe

Filesize
308KB

MD5
57cd27197396bb1efaefd85c129de708

SHA1
46493512f479e688d7b75249f308aea290ef5975

SHA256
7d7b13e6cc503a379ab9874d67f791f57dea7a108431b71d04db8efe3abd6b76

SHA512
9b26675486d69945efdfbbdbce3f158117ce35a496c9f68537e99765f79b002e530b9a769f22a7282661a4085b50089d2458256d9728f9cc58505f8276ffcaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9703.exe

Filesize
366KB

MD5
64a066aeb20f1bcfe39b5661230e40d8

SHA1
9b6355f403800020ffe98d8391d554e64b20f793

SHA256
f7df0fadafc631d9201fdfb1ddd373a05e1eea8429ba99eb5ae285a2fee40936

SHA512
5eb1d9996f19a4515ce94dd5fa9f686eb21487f3d84a4d84951555ec923f63ea7cc48228b5b7e7ffa9c30885a8001686c87650a9884b003d44b58407729b9062

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9703.exe

Filesize
366KB

MD5
64a066aeb20f1bcfe39b5661230e40d8

SHA1
9b6355f403800020ffe98d8391d554e64b20f793

SHA256
f7df0fadafc631d9201fdfb1ddd373a05e1eea8429ba99eb5ae285a2fee40936

SHA512
5eb1d9996f19a4515ce94dd5fa9f686eb21487f3d84a4d84951555ec923f63ea7cc48228b5b7e7ffa9c30885a8001686c87650a9884b003d44b58407729b9062

Download Submit
memory/2116-162-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-151-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-152-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-154-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-153-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-158-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-156-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-160-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-164-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-150-0x0000000004E50000-0x00000000053F4000-memory.dmp

Filesize
5.6MB

Download
memory/2116-166-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-168-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-170-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-172-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-174-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-176-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-178-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-180-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/2116-181-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/2116-182-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-183-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-184-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-186-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/2116-149-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2116-148-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/4392-1105-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-216-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-192-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-207-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-198-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-200-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-202-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-204-0x0000000000930000-0x000000000097B000-memory.dmp

Filesize
300KB

Download
memory/4392-206-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-196-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-209-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-210-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-212-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-205-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-214-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-1108-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-218-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-220-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-222-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-224-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-226-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-228-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-1101-0x0000000005320000-0x0000000005938000-memory.dmp

Filesize
6.1MB

Download
memory/4392-1102-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Filesize
1.0MB

Download
memory/4392-1103-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/4392-1104-0x0000000005B60000-0x0000000005B9C000-memory.dmp

Filesize
240KB

Download
memory/4392-194-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-1107-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-191-0x00000000052A0000-0x00000000052DE000-memory.dmp

Filesize
248KB

Download
memory/4392-1109-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4392-1110-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download