redline | 1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef

General

Target

1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe
Size

305KB
MD5

8505b9bef2a956942d7a02be6f697c7a
SHA1

4eb49a3d5c123477590566fdf89bfac9d4aded30
SHA256

1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef
SHA512

9d13f2520170afda2e29088d7fafe878e080da29f0e9dcf85dcbcd294fe0d25db2e5b1ab7f3be417261dd3bcc7f38ec96dc384ce242ac59eb4761dee45d9843a
SSDEEP

6144:Kby+bnr+Fp0yN90QE4S/DXfmp3udzQTBmLqtMqFYwtWphwJc:tMrZy90fbXfBWTRDC/phcc

Score

10^/10

redline mols evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mols

C2

77.91.68.253:41783

Attributes

auth_value
a4802ffb2e6c2a918243481cbc165a32

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7573667.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4692	a7573667.exe
4772	b1397571.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a7573667.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7573667.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	a7573667.exe
4692	a7573667.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	a7573667.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4692	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	85
PID 1112 wrote to memory of 4692	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	85
PID 1112 wrote to memory of 4692	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	85
PID 1112 wrote to memory of 4772	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	86
PID 1112 wrote to memory of 4772	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	86
PID 1112 wrote to memory of 4772	1112	1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe	86

C:\Users\Admin\AppData\Local\Temp\1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe
"C:\Users\Admin\AppData\Local\Temp\1faa9b3ba6ee5a123bba3cc2213b9b82c83da7c7fa664652a335558d455832ef.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a7573667.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a7573667.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1397571.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1397571.exe
  2⤵
  - Executes dropped EXE
  PID:4772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a7573667.exe

Filesize
184KB

MD5
4c94e0df16c58143287479c74f3e54e7

SHA1
f93129b20ac587e95b91f611d4c58b3005b140a9

SHA256
c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

SHA512
72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a7573667.exe

Filesize
184KB

MD5
4c94e0df16c58143287479c74f3e54e7

SHA1
f93129b20ac587e95b91f611d4c58b3005b140a9

SHA256
c55f04038db70d84fe431937ecf878573a31f0777ea612ad482f76c9a9968a2f

SHA512
72d63fafde9940b14b6ffcad664c287adadee194d8bd3cd685916814ab2b6be4fee82cd6af2035433a1ec39609d2a4ca74cffa414a92182c06ccd4d86b085f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1397571.exe

Filesize
145KB

MD5
fec5808f4572bd13e6ecce2ce4223b3f

SHA1
e95dc3f3cc942064780b87641263ba8903655eef

SHA256
faf508f972154b900f643dc928c8a0617620a708e6cffaf3c40d9426194cda86

SHA512
ace8fd00b18ca57a7c592a2f45d05dbe637406faf17a31f5c814a489ae9e56400f1069c6c342189b49109b61fe746e680576f490de4a9215b55f86fbf74f7dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1397571.exe

Filesize
145KB

MD5
fec5808f4572bd13e6ecce2ce4223b3f

SHA1
e95dc3f3cc942064780b87641263ba8903655eef

SHA256
faf508f972154b900f643dc928c8a0617620a708e6cffaf3c40d9426194cda86

SHA512
ace8fd00b18ca57a7c592a2f45d05dbe637406faf17a31f5c814a489ae9e56400f1069c6c342189b49109b61fe746e680576f490de4a9215b55f86fbf74f7dc4

Download Submit
memory/4692-148-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-166-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-143-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-146-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-142-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4692-152-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-150-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-154-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-156-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-158-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-160-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-162-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-164-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-144-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-168-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-170-0x0000000002570000-0x0000000002586000-memory.dmp

Filesize
88KB

Download
memory/4692-171-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4692-172-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4692-173-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4692-141-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4692-140-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/4772-178-0x0000000000840000-0x000000000086A000-memory.dmp

Filesize
168KB

Download
memory/4772-179-0x0000000005680000-0x0000000005C98000-memory.dmp

Filesize
6.1MB

Download
memory/4772-180-0x00000000051A0000-0x00000000052AA000-memory.dmp

Filesize
1.0MB

Download
memory/4772-181-0x00000000050D0000-0x00000000050E2000-memory.dmp

Filesize
72KB

Download
memory/4772-182-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/4772-183-0x0000000005150000-0x000000000518C000-memory.dmp

Filesize
240KB

Download
memory/4772-184-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads