redline | ff19ac956ccbf295cf9364d8cca046c7bd4c01758ae584e518d232f7d79cbf2c

Analysis

max time kernel
153s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2023 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

852KB
MD5

9242073efee74a0b32156d931e70d902
SHA1

19bba236a058e4083fcfc3771b75ca73e1b4522c
SHA256

ff19ac956ccbf295cf9364d8cca046c7bd4c01758ae584e518d232f7d79cbf2c
SHA512

e08f0778e968ad2b0f29a9ff9a5ca0ebc0f91b7bc5bc3f2cbcb18da01e1522c5e26591fb71869593ea634f51e9dcd05b78f53a1a61ef51f8fb91d2865f85e3b0
SSDEEP

24576:syFs53JHim2gszlC/iftA2238wJON1Au2:bFs59im2zz2iftTS8v1

Score

10^/10

redline diza lada evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

185.161.248.90:4125

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pr947630.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr947630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr947630.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr947630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr947630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr947630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr947630.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qu333994.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	qu333994.exe

Executes dropped EXE 5 IoCs

Processes:

un559297.exepr947630.exequ333994.exe1.exesi118365.exe

pid process

3912 un559297.exe
2692 pr947630.exe
2392 qu333994.exe
4280 1.exe
2260 si118365.exe

pid	process
3912	un559297.exe
2692	pr947630.exe
2392	qu333994.exe
4280	1.exe
2260	si118365.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pr947630.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr947630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr947630.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tmp.exeun559297.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un559297.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un559297.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3308 2692 WerFault.exe pr947630.exe
4400 2392 WerFault.exe qu333994.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pr947630.exe

pid process

2692 pr947630.exe
2692 pr947630.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pr947630.exequ333994.exe

description pid process

Token: SeDebugPrivilege 2692 pr947630.exe
Token: SeDebugPrivilege 2392 qu333994.exe

pid	pid_target	process	target process
3308	2692	WerFault.exe	pr947630.exe
4400	2392	WerFault.exe	qu333994.exe

pid	process
2692	pr947630.exe
2692	pr947630.exe

description	pid	process
Token: SeDebugPrivilege	2692	pr947630.exe
Token: SeDebugPrivilege	2392	qu333994.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

tmp.exeun559297.exequ333994.exe

description	pid	process	target process
PID 1056 wrote to memory of 3912	1056	tmp.exe	un559297.exe
PID 1056 wrote to memory of 3912	1056	tmp.exe	un559297.exe
PID 1056 wrote to memory of 3912	1056	tmp.exe	un559297.exe
PID 3912 wrote to memory of 2692	3912	un559297.exe	pr947630.exe
PID 3912 wrote to memory of 2692	3912	un559297.exe	pr947630.exe
PID 3912 wrote to memory of 2692	3912	un559297.exe	pr947630.exe
PID 3912 wrote to memory of 2392	3912	un559297.exe	qu333994.exe
PID 3912 wrote to memory of 2392	3912	un559297.exe	qu333994.exe
PID 3912 wrote to memory of 2392	3912	un559297.exe	qu333994.exe
PID 2392 wrote to memory of 4280	2392	qu333994.exe	1.exe
PID 2392 wrote to memory of 4280	2392	qu333994.exe	1.exe
PID 2392 wrote to memory of 4280	2392	qu333994.exe	1.exe
PID 1056 wrote to memory of 2260	1056	tmp.exe	si118365.exe
PID 1056 wrote to memory of 2260	1056	tmp.exe	si118365.exe
PID 1056 wrote to memory of 2260	1056	tmp.exe	si118365.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559297.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559297.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr947630.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr947630.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1092
      4⤵
      Program crash
      PID:3308
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu333994.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu333994.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1456
      4⤵
      Program crash
      PID:4400
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si118365.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si118365.exe
  2⤵
  - Executes dropped EXE
  PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2692 -ip 2692
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2392 -ip 2392
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si118365.exe

Filesize
168KB

MD5
c52ebada00a59ec1f651a0e9fbcef2eb

SHA1
e1941278df76616f1ca3202ef2a9f99d2592d52f

SHA256
35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

SHA512
6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si118365.exe

Filesize
168KB

MD5
c52ebada00a59ec1f651a0e9fbcef2eb

SHA1
e1941278df76616f1ca3202ef2a9f99d2592d52f

SHA256
35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

SHA512
6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559297.exe

Filesize
699KB

MD5
adee2f217ba3da4aace10c7c7f457a84

SHA1
b240365d111587f21ade6d9c9a658f83b4f1564e

SHA256
b3d9fa611fb0573a635c4b74a286679b8eab6ee7005f029059ae13320d1deea1

SHA512
857196bb991c9e15fd0ae041e6f4811b1c3c641420b88866d4bba3faa707e9c54b15358170bf11260c99912c7d29433a1c640bad9f04faa842c3ec435b25f2fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559297.exe

Filesize
699KB

MD5
adee2f217ba3da4aace10c7c7f457a84

SHA1
b240365d111587f21ade6d9c9a658f83b4f1564e

SHA256
b3d9fa611fb0573a635c4b74a286679b8eab6ee7005f029059ae13320d1deea1

SHA512
857196bb991c9e15fd0ae041e6f4811b1c3c641420b88866d4bba3faa707e9c54b15358170bf11260c99912c7d29433a1c640bad9f04faa842c3ec435b25f2fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr947630.exe

Filesize
402KB

MD5
8e05d287e829a2120e02b823e5db23af

SHA1
9065aa337cb06eaed500cbb46392ae3fcceae234

SHA256
3ef0297b15e39095ba9f2e57da342f7a6092b32fc941abebe9695af6f53d4bb5

SHA512
9b215b6a70933f3aa9394cd5abd56ca4ae7db52d6dc2c6750d97fe0e3a409fe9386c80b554fadafacaf4cdf941d174d942844eb6db16b29aefab9c5f8c369abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr947630.exe

Filesize
402KB

MD5
8e05d287e829a2120e02b823e5db23af

SHA1
9065aa337cb06eaed500cbb46392ae3fcceae234

SHA256
3ef0297b15e39095ba9f2e57da342f7a6092b32fc941abebe9695af6f53d4bb5

SHA512
9b215b6a70933f3aa9394cd5abd56ca4ae7db52d6dc2c6750d97fe0e3a409fe9386c80b554fadafacaf4cdf941d174d942844eb6db16b29aefab9c5f8c369abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu333994.exe

Filesize
586KB

MD5
893840b8e6fd520cdddae7ba8bfdf718

SHA1
b110af83f6920f71e12ac45bae653a7efe25d62b

SHA256
6f7cafae1078b11666765ba754f1eb11a35983e0c56f10440e2a06e93dbd0026

SHA512
b956e1b036f9a10711dec18ff39ca43c007426c5ed0d6431c29a3f324c87e6856cb39b815ae5a7a57f2f96c56491cd8027742620aa7f88c6d87972707caa0055

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu333994.exe

Filesize
586KB

MD5
893840b8e6fd520cdddae7ba8bfdf718

SHA1
b110af83f6920f71e12ac45bae653a7efe25d62b

SHA256
6f7cafae1078b11666765ba754f1eb11a35983e0c56f10440e2a06e93dbd0026

SHA512
b956e1b036f9a10711dec18ff39ca43c007426c5ed0d6431c29a3f324c87e6856cb39b815ae5a7a57f2f96c56491cd8027742620aa7f88c6d87972707caa0055

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/2260-2362-0x0000000000340000-0x0000000000370000-memory.dmp

Filesize
192KB

Download
memory/2260-2363-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2260-2365-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2392-225-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-2346-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2392-229-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-227-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-223-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-221-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-219-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-215-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-217-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-214-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2392-212-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2392-211-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-210-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2392-207-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-208-0x0000000000990000-0x00000000009EB000-memory.dmp

Filesize
364KB

Download
memory/2392-205-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-203-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-201-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-192-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-193-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-195-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-197-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2392-199-0x0000000005510000-0x0000000005570000-memory.dmp

Filesize
384KB

Download
memory/2692-166-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-181-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/2692-187-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/2692-160-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-184-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2692-183-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2692-182-0x0000000002460000-0x000000000248D000-memory.dmp

Filesize
180KB

Download
memory/2692-156-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-180-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-178-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-176-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-174-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-172-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-164-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-158-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-168-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-185-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2692-162-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-170-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-154-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-153-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2692-148-0x0000000002460000-0x000000000248D000-memory.dmp

Filesize
180KB

Download
memory/2692-149-0x0000000005050000-0x00000000055F4000-memory.dmp

Filesize
5.6MB

Download
memory/2692-150-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2692-151-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2692-152-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4280-2358-0x00000000055B0000-0x00000000055EC000-memory.dmp

Filesize
240KB

Download
memory/4280-2356-0x0000000001430000-0x0000000001440000-memory.dmp

Filesize
64KB

Download
memory/4280-2354-0x0000000005550000-0x0000000005562000-memory.dmp

Filesize
72KB

Download
memory/4280-2353-0x0000000005630000-0x000000000573A000-memory.dmp

Filesize
1.0MB

Download
memory/4280-2352-0x0000000005B40000-0x0000000006158000-memory.dmp

Filesize
6.1MB

Download
memory/4280-2364-0x0000000001430000-0x0000000001440000-memory.dmp

Filesize
64KB

Download
memory/4280-2351-0x0000000000C00000-0x0000000000C2E000-memory.dmp

Filesize
184KB

Download