redline | c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc

Analysis

max time kernel
229s
max time network
247s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe
Size

565KB
MD5

b780628241f7884fa7692d2de458492c
SHA1

42d423f7b391e47837f988a539fe03e08a42991e
SHA256

c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc
SHA512

792e1e3cfc9901b5c5874c5130f8a2ccdfc42f3760e00e1066e2694f0c58df55c12d7a709fa00e30f7800c7f055b4cc944359e53faa2e61f4b9e568d47031f0a
SSDEEP

12288:LMrEy90MQ5VquKZVedgAu57esaTCL3uT294PykeEIL8NU:7yDQnKbedg2bWL+T2Yy9L8q

Score

10^/10

redline darm discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	l1644864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	l1644864.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	l1644864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	l1644864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	l1644864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	l1644864.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1580	y1684172.exe
1848	k5276606.exe
1764	l1644864.exe

Loads dropped DLL 6 IoCs

pid	Process
1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe
1580	y1684172.exe
1580	y1684172.exe
1848	k5276606.exe
1580	y1684172.exe
1764	l1644864.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	l1644864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	l1644864.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y1684172.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1684172.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1848	k5276606.exe
1848	k5276606.exe
1764	l1644864.exe
1764	l1644864.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	k5276606.exe
Token: SeDebugPrivilege	1764	l1644864.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1784 wrote to memory of 1580	1784	c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe	28
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1848	1580	y1684172.exe	29
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31
PID 1580 wrote to memory of 1764	1580	y1684172.exe	31

C:\Users\Admin\AppData\Local\Temp\c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe
"C:\Users\Admin\AppData\Local\Temp\c8f09bc8de0896611629f879f2e823bc0ffd1b49f6daeba2521fcf5cd735eebc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe

Filesize
307KB

MD5
d6342410b7a065a8271f86a021abe30b

SHA1
f52c8f152caa388a9c9a8b15077e0b8a498b66f2

SHA256
5de876577b43ec610194bdabb84ca36be9724dfa1d974c56dc8346f5661929fc

SHA512
cf8e686c853d3d4037f7c57a603275e732ae0b1b329d2b71a271d55669eb5f1d7cc0aead49a20c98d11ce9831c5a12a8f0cfb30601635f0b20c4a9b7e3c85d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe

Filesize
307KB

MD5
d6342410b7a065a8271f86a021abe30b

SHA1
f52c8f152caa388a9c9a8b15077e0b8a498b66f2

SHA256
5de876577b43ec610194bdabb84ca36be9724dfa1d974c56dc8346f5661929fc

SHA512
cf8e686c853d3d4037f7c57a603275e732ae0b1b329d2b71a271d55669eb5f1d7cc0aead49a20c98d11ce9831c5a12a8f0cfb30601635f0b20c4a9b7e3c85d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe

Filesize
169KB

MD5
656d7938fb4e03bfa4947a0f11ca0118

SHA1
43bcd8f5a1f2d90a7492ad50cf30e5501205156a

SHA256
1701eab4aeb6dc232ec880be0dc50b58b00f45ff345222449bd6b7c63f2e1ab8

SHA512
7ae1f6555fdb3053e5b1ea3b56a075b751b4bf69e853af3930f883e4d67db3212376a55cbf6558572b1049aa85dbaae978c660b1b1c57bcfc8a6ad356c9f6f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe

Filesize
169KB

MD5
656d7938fb4e03bfa4947a0f11ca0118

SHA1
43bcd8f5a1f2d90a7492ad50cf30e5501205156a

SHA256
1701eab4aeb6dc232ec880be0dc50b58b00f45ff345222449bd6b7c63f2e1ab8

SHA512
7ae1f6555fdb3053e5b1ea3b56a075b751b4bf69e853af3930f883e4d67db3212376a55cbf6558572b1049aa85dbaae978c660b1b1c57bcfc8a6ad356c9f6f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe

Filesize
178KB

MD5
638d4036f9796dde96cd018dfb267e05

SHA1
b27b2fe233db341e0da3634b3107bab93ddce152

SHA256
b8ee0890d72f322c760dffc39bd56bd8c35306aa4a2cf9543ab2a7f967c95e0a

SHA512
2e81e904af46e720a677613894ae005e22d2d740915641037d4e9818eef5017acc044fce4767c9adba2b77af12c6773da4675e1ae8b808969e14804b2c187529

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe

Filesize
178KB

MD5
638d4036f9796dde96cd018dfb267e05

SHA1
b27b2fe233db341e0da3634b3107bab93ddce152

SHA256
b8ee0890d72f322c760dffc39bd56bd8c35306aa4a2cf9543ab2a7f967c95e0a

SHA512
2e81e904af46e720a677613894ae005e22d2d740915641037d4e9818eef5017acc044fce4767c9adba2b77af12c6773da4675e1ae8b808969e14804b2c187529

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe

Filesize
307KB

MD5
d6342410b7a065a8271f86a021abe30b

SHA1
f52c8f152caa388a9c9a8b15077e0b8a498b66f2

SHA256
5de876577b43ec610194bdabb84ca36be9724dfa1d974c56dc8346f5661929fc

SHA512
cf8e686c853d3d4037f7c57a603275e732ae0b1b329d2b71a271d55669eb5f1d7cc0aead49a20c98d11ce9831c5a12a8f0cfb30601635f0b20c4a9b7e3c85d8e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1684172.exe

Filesize
307KB

MD5
d6342410b7a065a8271f86a021abe30b

SHA1
f52c8f152caa388a9c9a8b15077e0b8a498b66f2

SHA256
5de876577b43ec610194bdabb84ca36be9724dfa1d974c56dc8346f5661929fc

SHA512
cf8e686c853d3d4037f7c57a603275e732ae0b1b329d2b71a271d55669eb5f1d7cc0aead49a20c98d11ce9831c5a12a8f0cfb30601635f0b20c4a9b7e3c85d8e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe

Filesize
169KB

MD5
656d7938fb4e03bfa4947a0f11ca0118

SHA1
43bcd8f5a1f2d90a7492ad50cf30e5501205156a

SHA256
1701eab4aeb6dc232ec880be0dc50b58b00f45ff345222449bd6b7c63f2e1ab8

SHA512
7ae1f6555fdb3053e5b1ea3b56a075b751b4bf69e853af3930f883e4d67db3212376a55cbf6558572b1049aa85dbaae978c660b1b1c57bcfc8a6ad356c9f6f8e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5276606.exe

Filesize
169KB

MD5
656d7938fb4e03bfa4947a0f11ca0118

SHA1
43bcd8f5a1f2d90a7492ad50cf30e5501205156a

SHA256
1701eab4aeb6dc232ec880be0dc50b58b00f45ff345222449bd6b7c63f2e1ab8

SHA512
7ae1f6555fdb3053e5b1ea3b56a075b751b4bf69e853af3930f883e4d67db3212376a55cbf6558572b1049aa85dbaae978c660b1b1c57bcfc8a6ad356c9f6f8e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe

Filesize
178KB

MD5
638d4036f9796dde96cd018dfb267e05

SHA1
b27b2fe233db341e0da3634b3107bab93ddce152

SHA256
b8ee0890d72f322c760dffc39bd56bd8c35306aa4a2cf9543ab2a7f967c95e0a

SHA512
2e81e904af46e720a677613894ae005e22d2d740915641037d4e9818eef5017acc044fce4767c9adba2b77af12c6773da4675e1ae8b808969e14804b2c187529

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1644864.exe

Filesize
178KB

MD5
638d4036f9796dde96cd018dfb267e05

SHA1
b27b2fe233db341e0da3634b3107bab93ddce152

SHA256
b8ee0890d72f322c760dffc39bd56bd8c35306aa4a2cf9543ab2a7f967c95e0a

SHA512
2e81e904af46e720a677613894ae005e22d2d740915641037d4e9818eef5017acc044fce4767c9adba2b77af12c6773da4675e1ae8b808969e14804b2c187529

Download Submit
memory/1764-100-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-96-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-118-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1764-117-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1764-84-0x0000000000360000-0x000000000037A000-memory.dmp

Filesize
104KB

Download
memory/1764-85-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1764-86-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1764-87-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1764-88-0x0000000000600000-0x0000000000618000-memory.dmp

Filesize
96KB

Download
memory/1764-89-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-90-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-92-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-94-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-116-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-98-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-114-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-102-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-104-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-106-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-108-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-110-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1764-112-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download
memory/1848-74-0x0000000000990000-0x00000000009C0000-memory.dmp

Filesize
192KB

Download
memory/1848-77-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/1848-75-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1848-76-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download