redline | 2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe
Size

699KB
MD5

aeac819d00e1da56cad01200e5d4df0a
SHA1

0c2b466a4bf1f6a94e327b365ddf3c8d3981a81a
SHA256

2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1
SHA512

f46a26921cd20d65e6cb1c469e64bfa42af0b0b5e3a74430ac435beb0c4d187a0004c4f00260596e16b8d719ee76e87ef959e6014ed1742d910924158e5179c1
SSDEEP

12288:EMrly904MSn6iXzBychHMmXZeUZjukHvYEmXfBRvKw8uY9jj6hX:Ry5nzcchs2ZjZZHvHmXf+9f6hX

Score

10^/10

redline sony evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9974.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9974.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9974.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9974.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9974.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9974.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/4432-194-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-192-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-197-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-199-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-201-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-203-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-205-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-207-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-209-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-211-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-213-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-215-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-217-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-219-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-221-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-223-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-225-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4432-227-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
3208	un991555.exe
3236	pro9974.exe
4432	qu8823.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9974.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9974.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un991555.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un991555.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2656	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3752	3236	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3236	pro9974.exe
3236	pro9974.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	pro9974.exe
Token: SeDebugPrivilege	4432	qu8823.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3208	2764	2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe	85
PID 2764 wrote to memory of 3208	2764	2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe	85
PID 2764 wrote to memory of 3208	2764	2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe	85
PID 3208 wrote to memory of 3236	3208	un991555.exe	86
PID 3208 wrote to memory of 3236	3208	un991555.exe	86
PID 3208 wrote to memory of 3236	3208	un991555.exe	86
PID 3208 wrote to memory of 4432	3208	un991555.exe	92
PID 3208 wrote to memory of 4432	3208	un991555.exe	92
PID 3208 wrote to memory of 4432	3208	un991555.exe	92

C:\Users\Admin\AppData\Local\Temp\2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe
"C:\Users\Admin\AppData\Local\Temp\2d97ef5189f9c04df861b3746856e293f96b59f1b6f4b6901735140af66aeff1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un991555.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un991555.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9974.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9974.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 1084
      4⤵
      Program crash
      PID:3752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8823.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3236 -ip 3236
1⤵
PID:1232

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un991555.exe

Filesize
558KB

MD5
7f40f39f04905f2e8928490b7483c1a5

SHA1
943cec68b052e875ddabd0fe766fe5b0d442cd9d

SHA256
2ef130640859ca8888e5c4168de2f9ff89a1e430bda1fd6dcb1201f913172325

SHA512
48de8dfc8643e0ed2339292c21959a8437682e9bdd354a66a1545a4ccac7327b068fb08cd6bfb11bdbd016717cf9d6566a95107752b6baa589f3f9b225c12693

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un991555.exe

Filesize
558KB

MD5
7f40f39f04905f2e8928490b7483c1a5

SHA1
943cec68b052e875ddabd0fe766fe5b0d442cd9d

SHA256
2ef130640859ca8888e5c4168de2f9ff89a1e430bda1fd6dcb1201f913172325

SHA512
48de8dfc8643e0ed2339292c21959a8437682e9bdd354a66a1545a4ccac7327b068fb08cd6bfb11bdbd016717cf9d6566a95107752b6baa589f3f9b225c12693

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9974.exe

Filesize
308KB

MD5
c55b40435d9b1d53e9126767d9eef0e1

SHA1
ebbc622bf1415079af511310f1a74d399192a885

SHA256
9d091478bd41051bae766ba1655f13cd5485dc9dea308f4d06ee726800638586

SHA512
9fdbc75a97a2af87d0583bd0df98fcec97d1494cd124eb8bcb96260913affcafc8d026cf780943147dc64c7209268e1f48cdba70209ab0c95e4b98ae71cce469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9974.exe

Filesize
308KB

MD5
c55b40435d9b1d53e9126767d9eef0e1

SHA1
ebbc622bf1415079af511310f1a74d399192a885

SHA256
9d091478bd41051bae766ba1655f13cd5485dc9dea308f4d06ee726800638586

SHA512
9fdbc75a97a2af87d0583bd0df98fcec97d1494cd124eb8bcb96260913affcafc8d026cf780943147dc64c7209268e1f48cdba70209ab0c95e4b98ae71cce469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8823.exe

Filesize
366KB

MD5
7b2e711566856fa975073a03cf120b05

SHA1
0d1337b163ba5776b8e03d6869357b39ee455ced

SHA256
7fdcded3e68dcc8ed4f2da055b9843f1578dc497b8ca0723e5ebaa120da1a85b

SHA512
c9dcb708e738d609228a10d2ed3c1c5d3c3e8fb71430764f17884987f2d3a1f996370eb26b89093be6cabfa327514a526ece686364f41ac40e919a7af55aed44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8823.exe

Filesize
366KB

MD5
7b2e711566856fa975073a03cf120b05

SHA1
0d1337b163ba5776b8e03d6869357b39ee455ced

SHA256
7fdcded3e68dcc8ed4f2da055b9843f1578dc497b8ca0723e5ebaa120da1a85b

SHA512
c9dcb708e738d609228a10d2ed3c1c5d3c3e8fb71430764f17884987f2d3a1f996370eb26b89093be6cabfa327514a526ece686364f41ac40e919a7af55aed44

Download Submit
memory/3236-148-0x0000000004DA0000-0x0000000005344000-memory.dmp

Filesize
5.6MB

Download
memory/3236-149-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/3236-150-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3236-151-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3236-152-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-153-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-155-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-157-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-159-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-161-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-163-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-165-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-167-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-169-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-171-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-173-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-175-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-177-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-179-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/3236-180-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/3236-181-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3236-182-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3236-183-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3236-185-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/4432-190-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/4432-194-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-192-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-193-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-191-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-195-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-197-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-199-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-201-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-203-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-205-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-207-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-209-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-211-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-213-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-215-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-217-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-219-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-221-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-223-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-225-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-227-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4432-1100-0x0000000005600000-0x0000000005C18000-memory.dmp

Filesize
6.1MB

Download
memory/4432-1101-0x0000000005C20000-0x0000000005D2A000-memory.dmp

Filesize
1.0MB

Download
memory/4432-1102-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/4432-1103-0x0000000004F80000-0x0000000004FBC000-memory.dmp

Filesize
240KB

Download
memory/4432-1104-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-1106-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-1107-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-1108-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4432-1109-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download