redline | 3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c

General

Target

3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe
Size

1.0MB
MD5

a9f148dd491fe7c9e00c534edbe46af1
SHA1

728fa3400720141a5b99aa32f0c2eb48e4170bc5
SHA256

3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c
SHA512

469492c4da9fbf508ce8f1745425cdbe43dbc0fa7b1c33ae4fa1c2103c04189247dbce24931c509e5810ea98593bba1641566dc9ac7570e6f8b17c6686a50815
SSDEEP

24576:KykSmY1w3fNWdqKLouh7Qb7cT+DwmzRewJorTT65xn7w:RTwYdqQh7qIUJmTTkx7

Score

10^/10

redline mixa evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.37:4138

Attributes

auth_value
9d14534b25ac495ab25b59800acf3bb2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4388396.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2196	v5066326.exe
760	v7789440.exe
4140	a4388396.exe
244	b0826757.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a4388396.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4388396.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7789440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7789440.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5066326.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5066326.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4140	a4388396.exe
4140	a4388396.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	a4388396.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2196	1996	3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe	85
PID 1996 wrote to memory of 2196	1996	3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe	85
PID 1996 wrote to memory of 2196	1996	3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe	85
PID 2196 wrote to memory of 760	2196	v5066326.exe	86
PID 2196 wrote to memory of 760	2196	v5066326.exe	86
PID 2196 wrote to memory of 760	2196	v5066326.exe	86
PID 760 wrote to memory of 4140	760	v7789440.exe	87
PID 760 wrote to memory of 4140	760	v7789440.exe	87
PID 760 wrote to memory of 4140	760	v7789440.exe	87
PID 760 wrote to memory of 244	760	v7789440.exe	88
PID 760 wrote to memory of 244	760	v7789440.exe	88
PID 760 wrote to memory of 244	760	v7789440.exe	88

C:\Users\Admin\AppData\Local\Temp\3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe
"C:\Users\Admin\AppData\Local\Temp\3bdfed68830ad4d8992d3a81c78af933f2909f34aad8b7818d856cb1adf7181c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5066326.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5066326.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7789440.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7789440.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4388396.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4388396.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0826757.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0826757.exe
      4⤵
      Executes dropped EXE
      PID:244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5066326.exe

Filesize
750KB

MD5
165ee11a59462356f665a79a95ad4f69

SHA1
82ed723f80cac70c1950debc0cd180f278553067

SHA256
eebfbf482b96d502372d92f9e1afe309b95186a918299a940c9b94edbcc41c0e

SHA512
4d9fd93f8f612f48a4af29988f2b5c9e6af1a8887dd0d2afea1ea2d2ad318608577da1e2d059ff53170a9b36e6c9f63c6ffcb8b0f271fbb12743e8d8d9a84062

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5066326.exe

Filesize
750KB

MD5
165ee11a59462356f665a79a95ad4f69

SHA1
82ed723f80cac70c1950debc0cd180f278553067

SHA256
eebfbf482b96d502372d92f9e1afe309b95186a918299a940c9b94edbcc41c0e

SHA512
4d9fd93f8f612f48a4af29988f2b5c9e6af1a8887dd0d2afea1ea2d2ad318608577da1e2d059ff53170a9b36e6c9f63c6ffcb8b0f271fbb12743e8d8d9a84062

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7789440.exe

Filesize
306KB

MD5
ba49466c1e0fafd1855be63b259d463a

SHA1
dd38ff3e1e50c49d3b90210f8a64a4ece598de89

SHA256
e4cb878b5710baf2293c01c13e0708b9a0057fcdb245eaca7d617b283ad1b5d6

SHA512
8da9fa097a6b07165a9a7e982e9cd23d3fc4f7db464a8c1c5d0b838b62533f2bcba2240d766192e350f28467f2c3ae0dfdc0e199b591c441c0eb3e88259b2b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7789440.exe

Filesize
306KB

MD5
ba49466c1e0fafd1855be63b259d463a

SHA1
dd38ff3e1e50c49d3b90210f8a64a4ece598de89

SHA256
e4cb878b5710baf2293c01c13e0708b9a0057fcdb245eaca7d617b283ad1b5d6

SHA512
8da9fa097a6b07165a9a7e982e9cd23d3fc4f7db464a8c1c5d0b838b62533f2bcba2240d766192e350f28467f2c3ae0dfdc0e199b591c441c0eb3e88259b2b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4388396.exe

Filesize
186KB

MD5
24ce1c0a8ec6c692f2f94b0bd6798928

SHA1
d9c5b69584a840694e7b4618d304b914bae4ec86

SHA256
3b3a167b3da2deeecd9fcc237e85d303d5346cb903ca96eca7208876bee46e17

SHA512
a9cc5796263b9f8112b145967b1f68b23a18ae74396777edd6b03d5d10d4f6f437c5e85dfa3bd94f9e7d2adeb1d893b6e6ca1ab5a7ff3c30e1b343420203b651

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4388396.exe

Filesize
186KB

MD5
24ce1c0a8ec6c692f2f94b0bd6798928

SHA1
d9c5b69584a840694e7b4618d304b914bae4ec86

SHA256
3b3a167b3da2deeecd9fcc237e85d303d5346cb903ca96eca7208876bee46e17

SHA512
a9cc5796263b9f8112b145967b1f68b23a18ae74396777edd6b03d5d10d4f6f437c5e85dfa3bd94f9e7d2adeb1d893b6e6ca1ab5a7ff3c30e1b343420203b651

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0826757.exe

Filesize
145KB

MD5
b024c4a9ea60de8f2212a423feea0444

SHA1
bb0f97ddf2ec92bd79e649c1625a15d02e8d6a61

SHA256
ae96c921f7f8fc3101b0ae6f2d3e89fde9f1ca22159bc3b2d5b012f51ba84260

SHA512
d782fa8ececc9b761b0fa49f3261224e7f621f60ee1eb6962a16a24c5777f5e2a216257cfe608f59dcd5327db38fee47df55a0aa5e3ef11fbebd3183fdf6c80c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0826757.exe

Filesize
145KB

MD5
b024c4a9ea60de8f2212a423feea0444

SHA1
bb0f97ddf2ec92bd79e649c1625a15d02e8d6a61

SHA256
ae96c921f7f8fc3101b0ae6f2d3e89fde9f1ca22159bc3b2d5b012f51ba84260

SHA512
d782fa8ececc9b761b0fa49f3261224e7f621f60ee1eb6962a16a24c5777f5e2a216257cfe608f59dcd5327db38fee47df55a0aa5e3ef11fbebd3183fdf6c80c

Download Submit
memory/244-198-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/244-197-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/244-196-0x0000000005550000-0x000000000558C000-memory.dmp

Filesize
240KB

Download
memory/244-195-0x00000000054C0000-0x00000000054D2000-memory.dmp

Filesize
72KB

Download
memory/244-194-0x0000000005590000-0x000000000569A000-memory.dmp

Filesize
1.0MB

Download
memory/244-193-0x0000000005A10000-0x0000000006028000-memory.dmp

Filesize
6.1MB

Download
memory/244-192-0x0000000000AF0000-0x0000000000B1A000-memory.dmp

Filesize
168KB

Download
memory/4140-157-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-187-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4140-172-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-174-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-176-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-178-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-180-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-182-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-184-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-185-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4140-186-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4140-170-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-168-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-166-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-164-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-162-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-160-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-158-0x0000000004AA0000-0x0000000004AB6000-memory.dmp

Filesize
88KB

Download
memory/4140-156-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4140-155-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4140-154-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads