redline | 61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02

Analysis

max time kernel
172s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe
Size

479KB
MD5

67e949f4c3d6c38347d961a6340704a9
SHA1

fedaf1602acc5522a99023e1331cd7f74ff7edf5
SHA256

61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02
SHA512

974d5bd870190e232476c9f8189c82307f8ec6e6495b29c7f8e7c229abe12155d1d2ecd64ff40c911da8c9ed829a9372fe604d9f96b08aeb5b55110544bc9bd7
SSDEEP

12288:vMrMy909a0mXe21alOuNEEG8HP8YjNB55MkE2/:byhvXkjg8v8gv5akV/

Score

10^/10

redline divan discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

divan

217.196.96.102:4132

Attributes

auth_value
b414986bebd7f5a3ec9aee0341b8e769

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h6651996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h6651996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h6651996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h6651996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h6651996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h6651996.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	i9862228.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 5 IoCs

pid	Process
4292	x7568251.exe
2824	g6623662.exe
4440	h6651996.exe
1856	i9862228.exe
1700	oneetx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h6651996.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h6651996.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7568251.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7568251.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2824	g6623662.exe
2824	g6623662.exe
4440	h6651996.exe
4440	h6651996.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	g6623662.exe
Token: SeDebugPrivilege	4440	h6651996.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	i9862228.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4292	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	82
PID 968 wrote to memory of 4292	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	82
PID 968 wrote to memory of 4292	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	82
PID 4292 wrote to memory of 2824	4292	x7568251.exe	84
PID 4292 wrote to memory of 2824	4292	x7568251.exe	84
PID 4292 wrote to memory of 2824	4292	x7568251.exe	84
PID 4292 wrote to memory of 4440	4292	x7568251.exe	91
PID 4292 wrote to memory of 4440	4292	x7568251.exe	91
PID 4292 wrote to memory of 4440	4292	x7568251.exe	91
PID 968 wrote to memory of 1856	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	92
PID 968 wrote to memory of 1856	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	92
PID 968 wrote to memory of 1856	968	61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe	92
PID 1856 wrote to memory of 1700	1856	i9862228.exe	93
PID 1856 wrote to memory of 1700	1856	i9862228.exe	93
PID 1856 wrote to memory of 1700	1856	i9862228.exe	93
PID 1700 wrote to memory of 3208	1700	oneetx.exe	94
PID 1700 wrote to memory of 3208	1700	oneetx.exe	94
PID 1700 wrote to memory of 3208	1700	oneetx.exe	94
PID 1700 wrote to memory of 2024	1700	oneetx.exe	96
PID 1700 wrote to memory of 2024	1700	oneetx.exe	96
PID 1700 wrote to memory of 2024	1700	oneetx.exe	96
PID 2024 wrote to memory of 2492	2024	cmd.exe	98
PID 2024 wrote to memory of 2492	2024	cmd.exe	98
PID 2024 wrote to memory of 2492	2024	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe
"C:\Users\Admin\AppData\Local\Temp\61d53a1491d53f257d5654316ad2055aba8554d0b05635f9069a7c21ae9bce02.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7568251.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7568251.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6623662.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6623662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6651996.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6651996.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9862228.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9862228.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9862228.exe

Filesize
212KB

MD5
b7ee7a9a57ac8e60ff91f069aa42611b

SHA1
21bf90a5dab791d57ab6685eaaa3c29b08de9c6b

SHA256
56808b977a30c46b78cb8f0e966e0ed79e2f4c5f47213ac513227878d85e5d47

SHA512
7fd511f20cb1ec2b02e1c874cac2da7f3399bd5f3a3fe48217470019f3a9b898338077b7342ae0011b403d25ee9f8dfb9da2101b5d1c6f3eb518b64830adda59

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9862228.exe

Filesize
212KB

MD5
b7ee7a9a57ac8e60ff91f069aa42611b

SHA1
21bf90a5dab791d57ab6685eaaa3c29b08de9c6b

SHA256
56808b977a30c46b78cb8f0e966e0ed79e2f4c5f47213ac513227878d85e5d47

SHA512
7fd511f20cb1ec2b02e1c874cac2da7f3399bd5f3a3fe48217470019f3a9b898338077b7342ae0011b403d25ee9f8dfb9da2101b5d1c6f3eb518b64830adda59

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7568251.exe

Filesize
307KB

MD5
211be941aab6c7f25e84923547043cc6

SHA1
14a24a61aca8a5bc75d549a644849a58358fe935

SHA256
355d79e0a0ffe94dc1e335b896df7e667676d853ba25087aed9cc11e948da6d0

SHA512
651df0ebb911b353bd1b4f1f49a9c8d29236f549290a693238e7cc54e2c46a16b0795f697bbf60f56d94d9ac0b896bafeebdb72b177e74b97c64052ab3b57fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7568251.exe

Filesize
307KB

MD5
211be941aab6c7f25e84923547043cc6

SHA1
14a24a61aca8a5bc75d549a644849a58358fe935

SHA256
355d79e0a0ffe94dc1e335b896df7e667676d853ba25087aed9cc11e948da6d0

SHA512
651df0ebb911b353bd1b4f1f49a9c8d29236f549290a693238e7cc54e2c46a16b0795f697bbf60f56d94d9ac0b896bafeebdb72b177e74b97c64052ab3b57fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6623662.exe

Filesize
168KB

MD5
4221c973c04b215f818968c2041e45c2

SHA1
4ba8dae78ac3f03ce582c9301be3d0593caf9843

SHA256
1b36c6ccb64b9e705dbceb160a24dd0b512d58dab7424642fea463db62b255c6

SHA512
ae531b39e0f5afcd3bfe13171d26d56df12010ded0d11c0178b200f54fc5775ebf4c8a6239d025b40fa75d348f78406df00dd032b747ea02de95e5a50b9bd8a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6623662.exe

Filesize
168KB

MD5
4221c973c04b215f818968c2041e45c2

SHA1
4ba8dae78ac3f03ce582c9301be3d0593caf9843

SHA256
1b36c6ccb64b9e705dbceb160a24dd0b512d58dab7424642fea463db62b255c6

SHA512
ae531b39e0f5afcd3bfe13171d26d56df12010ded0d11c0178b200f54fc5775ebf4c8a6239d025b40fa75d348f78406df00dd032b747ea02de95e5a50b9bd8a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6651996.exe

Filesize
181KB

MD5
ea8ebdb56a0fa77176991143ea8a1b19

SHA1
2672b5233e669ea6afc067e8c34b950136db333c

SHA256
ea3ea26a6ee5b7efb73847218a1b570f31e312b21c3bc8bba45d18ce072fe28a

SHA512
82300c0e77284f0ba9126e8c17329032d216e74330b590d9fb95ec828f840ea4d069ac05c4ed77e89daa89a6d5b049cbe1c00d8224c08e50f9749b31e6809ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6651996.exe

Filesize
181KB

MD5
ea8ebdb56a0fa77176991143ea8a1b19

SHA1
2672b5233e669ea6afc067e8c34b950136db333c

SHA256
ea3ea26a6ee5b7efb73847218a1b570f31e312b21c3bc8bba45d18ce072fe28a

SHA512
82300c0e77284f0ba9126e8c17329032d216e74330b590d9fb95ec828f840ea4d069ac05c4ed77e89daa89a6d5b049cbe1c00d8224c08e50f9749b31e6809ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
212KB

MD5
b7ee7a9a57ac8e60ff91f069aa42611b

SHA1
21bf90a5dab791d57ab6685eaaa3c29b08de9c6b

SHA256
56808b977a30c46b78cb8f0e966e0ed79e2f4c5f47213ac513227878d85e5d47

SHA512
7fd511f20cb1ec2b02e1c874cac2da7f3399bd5f3a3fe48217470019f3a9b898338077b7342ae0011b403d25ee9f8dfb9da2101b5d1c6f3eb518b64830adda59

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
212KB

MD5
b7ee7a9a57ac8e60ff91f069aa42611b

SHA1
21bf90a5dab791d57ab6685eaaa3c29b08de9c6b

SHA256
56808b977a30c46b78cb8f0e966e0ed79e2f4c5f47213ac513227878d85e5d47

SHA512
7fd511f20cb1ec2b02e1c874cac2da7f3399bd5f3a3fe48217470019f3a9b898338077b7342ae0011b403d25ee9f8dfb9da2101b5d1c6f3eb518b64830adda59

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
212KB

MD5
b7ee7a9a57ac8e60ff91f069aa42611b

SHA1
21bf90a5dab791d57ab6685eaaa3c29b08de9c6b

SHA256
56808b977a30c46b78cb8f0e966e0ed79e2f4c5f47213ac513227878d85e5d47

SHA512
7fd511f20cb1ec2b02e1c874cac2da7f3399bd5f3a3fe48217470019f3a9b898338077b7342ae0011b403d25ee9f8dfb9da2101b5d1c6f3eb518b64830adda59

Download Submit
memory/2824-150-0x000000000A020000-0x000000000A12A000-memory.dmp

Filesize
1.0MB

Download
memory/2824-155-0x00000000006F0000-0x0000000000766000-memory.dmp

Filesize
472KB

Download
memory/2824-157-0x000000000A470000-0x000000000A4D6000-memory.dmp

Filesize
408KB

Download
memory/2824-158-0x000000000B400000-0x000000000B9A4000-memory.dmp

Filesize
5.6MB

Download
memory/2824-159-0x000000000B170000-0x000000000B332000-memory.dmp

Filesize
1.8MB

Download
memory/2824-160-0x000000000BEE0000-0x000000000C40C000-memory.dmp

Filesize
5.2MB

Download
memory/2824-161-0x000000000B050000-0x000000000B0A0000-memory.dmp

Filesize
320KB

Download
memory/2824-156-0x0000000000910000-0x00000000009A2000-memory.dmp

Filesize
584KB

Download
memory/2824-154-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2824-153-0x0000000009F70000-0x0000000009FAC000-memory.dmp

Filesize
240KB

Download
memory/2824-152-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2824-151-0x0000000009F10000-0x0000000009F22000-memory.dmp

Filesize
72KB

Download
memory/2824-149-0x000000000A530000-0x000000000AB48000-memory.dmp

Filesize
6.1MB

Download
memory/2824-148-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/4440-169-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-177-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-179-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-181-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-183-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-185-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-187-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-189-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-191-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-193-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-194-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-195-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-196-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-197-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-198-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-199-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/4440-175-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-173-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-171-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-167-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/4440-166-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download