redline | 8af32f3ea4635d8b35ae555aeb954d087acbf0225580d8bf929adc7426fe8932

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
874d88dae0610f6bb5af09ff1372fa8b.exe
Size 767KB
Sample230525-whe2dsbf24
SHA256 8af32f3ea4635d8b35ae555aeb954d087acbf0225580d8bf929adc7426fe8932
MD5 874d88dae0610f6bb5af09ff1372fa8b
SHA1 d225a8cfa472089f6b63edbd4d6d0174eb043429
SHA512 2736cb6fa30502e1de266f90c96830ffa23065c776c1659140f89497586d982d97ade78007263e03a2f668d8ec1fc5c89c56f636a3f2820355d4d07cd1f3b741
SSDEEP 12288:DMrDy90Z1AHfCvx2cBxxX6NvcQ0r2riIsCHcLEvkggS+fKavRsjWjEJUk:ky7HfCp2I3KNk52r18mkgf+ymsjbUk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dina evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dina

83.97.73.122:19062

Attributes

auth_value
4f77073adc624269de1bff760b9bc471

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1568	y2959451.exe
3132	y7043749.exe
4708	k7450903.exe
1040	l5556597.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2959451.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7043749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7043749.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	874d88dae0610f6bb5af09ff1372fa8b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	874d88dae0610f6bb5af09ff1372fa8b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2959451.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 1380	4708	k7450903.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1380	AppLaunch.exe
1380	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1568	3440	874d88dae0610f6bb5af09ff1372fa8b.exe	84
PID 3440 wrote to memory of 1568	3440	874d88dae0610f6bb5af09ff1372fa8b.exe	84
PID 3440 wrote to memory of 1568	3440	874d88dae0610f6bb5af09ff1372fa8b.exe	84
PID 1568 wrote to memory of 3132	1568	y2959451.exe	85
PID 1568 wrote to memory of 3132	1568	y2959451.exe	85
PID 1568 wrote to memory of 3132	1568	y2959451.exe	85
PID 3132 wrote to memory of 4708	3132	y7043749.exe	86
PID 3132 wrote to memory of 4708	3132	y7043749.exe	86
PID 3132 wrote to memory of 4708	3132	y7043749.exe	86
PID 4708 wrote to memory of 1380	4708	k7450903.exe	88
PID 4708 wrote to memory of 1380	4708	k7450903.exe	88
PID 4708 wrote to memory of 1380	4708	k7450903.exe	88
PID 4708 wrote to memory of 1380	4708	k7450903.exe	88
PID 4708 wrote to memory of 1380	4708	k7450903.exe	88
PID 3132 wrote to memory of 1040	3132	y7043749.exe	89
PID 3132 wrote to memory of 1040	3132	y7043749.exe	89
PID 3132 wrote to memory of 1040	3132	y7043749.exe	89

C:\Users\Admin\AppData\Local\Temp\874d88dae0610f6bb5af09ff1372fa8b.exe
"C:\Users\Admin\AppData\Local\Temp\874d88dae0610f6bb5af09ff1372fa8b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2959451.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2959451.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7043749.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7043749.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7450903.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7450903.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5556597.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5556597.exe
      4⤵
      Executes dropped EXE
      PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y2959451.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2959451.exe
Size 448KB
SHA256 051837daa9b2152831e05cd459cb01e92e0d9dbea503b8979fa9883199f9cbfe
MD5 c745a15d403e266a292f38dd671113d3
SHA1 187f6c710a895cc76491025c354ca4f7bbb73fa8
SHA512 15b1bace55b32ce255dcc95f5ee2502f33a837a7466bb50f80ff5b2e32d01c70ab5ee77da479e11240b5b9215676878e9a053078a5b3bd820fdad10258eb146f
SSDEEP 6144:Kcy+bnr+5p0yN90QEY/9nR3J5pePPXQUYsvhHNdJ3JrvPjZhrUAgysh46WkHPwn:UMrxy90S9J5UXQ4vhrXrvrQUstHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

y2959451.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2959451.exe
Size 448KB
SHA256 051837daa9b2152831e05cd459cb01e92e0d9dbea503b8979fa9883199f9cbfe
MD5 c745a15d403e266a292f38dd671113d3
SHA1 187f6c710a895cc76491025c354ca4f7bbb73fa8
SHA512 15b1bace55b32ce255dcc95f5ee2502f33a837a7466bb50f80ff5b2e32d01c70ab5ee77da479e11240b5b9215676878e9a053078a5b3bd820fdad10258eb146f
SSDEEP 6144:Kcy+bnr+5p0yN90QEY/9nR3J5pePPXQUYsvhHNdJ3JrvPjZhrUAgysh46WkHPwn:UMrxy90S9J5UXQ4vhrXrvrQUstHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7043749.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7043749.exe
Size 277KB
SHA256 98d3aa1babff02803b495afb12e2d4517ee3ca0181a874fb475c36b0b9336082
MD5 7c727422e993cd4265bf36e9fb4ef8cd
SHA1 6d5fa986ea72fed111890d7d5a3441bf8a4cd042
SHA512 c65e9f7678f669c51f25689c2df9d81921ccea4647793ad39d5c85c6abb14ef12bc37026ca98de1df6cd13f99ed6ee396ef80291c722fbf22093dd2177de3bff
SSDEEP 6144:K5y+bnr+2p0yN90QElySNdYg+rvPjZh+Q:nMrmy90/y+ervrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7043749.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7043749.exe
Size 277KB
SHA256 98d3aa1babff02803b495afb12e2d4517ee3ca0181a874fb475c36b0b9336082
MD5 7c727422e993cd4265bf36e9fb4ef8cd
SHA1 6d5fa986ea72fed111890d7d5a3441bf8a4cd042
SHA512 c65e9f7678f669c51f25689c2df9d81921ccea4647793ad39d5c85c6abb14ef12bc37026ca98de1df6cd13f99ed6ee396ef80291c722fbf22093dd2177de3bff
SSDEEP 6144:K5y+bnr+2p0yN90QElySNdYg+rvPjZh+Q:nMrmy90/y+ervrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

k7450903.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7450903.exe
Size 188KB
SHA256 f958c7815e96154c0dc13f836c51745236a2f3152f8ddef64349fb1cd790092c
MD5 6d20f5bb3c7fb7590b44a3cea60324bf
SHA1 de9c5f73e087a64d71c8af551082278751d63e6f
SHA512 6c1845d58590b92258a31f47f462acea7b51f2b3fd429e75c508bb064cddef4f7bd926477a0f7dfb15d79b0ce41c97577b840dcb6197afa0e63c84a967e46f60
SSDEEP 3072:yORHmpG1tLqKctWqBDH2M+kAy4Fc77NUWyUWeOx5ITx:yIPLBctpb+kAy4F2Vy
MD5 SHA1 SHA512 SSDEEP

Submit Download

k7450903.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7450903.exe
Size 188KB
SHA256 f958c7815e96154c0dc13f836c51745236a2f3152f8ddef64349fb1cd790092c
MD5 6d20f5bb3c7fb7590b44a3cea60324bf
SHA1 de9c5f73e087a64d71c8af551082278751d63e6f
SHA512 6c1845d58590b92258a31f47f462acea7b51f2b3fd429e75c508bb064cddef4f7bd926477a0f7dfb15d79b0ce41c97577b840dcb6197afa0e63c84a967e46f60
SSDEEP 3072:yORHmpG1tLqKctWqBDH2M+kAy4Fc77NUWyUWeOx5ITx:yIPLBctpb+kAy4F2Vy
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5556597.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5556597.exe
Size 145KB
SHA256 1181f53b0536dbe6883a3a2ec78121d5ec015cae67d955e1c01c938bcf639b3b
MD5 6680cdbf1b4bb79769251d88d9827ae0
SHA1 c9309f6d14c3910b34166878ed9914475c95a514
SHA512 249c350bac524543f7ed8c46ccaf1f27c525a148a92f1bab08f16555b351c14f7a0f71f522d4a314f1b98fa6c06b0ba0a7184f0ea00f569feed0914c5f7be384
SSDEEP 3072:TV+m5clQmRSRNrncqvQ8nVBNDBhwZq8e8hJ:Tjor211BhwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5556597.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5556597.exe
Size 145KB
SHA256 1181f53b0536dbe6883a3a2ec78121d5ec015cae67d955e1c01c938bcf639b3b
MD5 6680cdbf1b4bb79769251d88d9827ae0
SHA1 c9309f6d14c3910b34166878ed9914475c95a514
SHA512 249c350bac524543f7ed8c46ccaf1f27c525a148a92f1bab08f16555b351c14f7a0f71f522d4a314f1b98fa6c06b0ba0a7184f0ea00f569feed0914c5f7be384
SSDEEP 3072:TV+m5clQmRSRNrncqvQ8nVBNDBhwZq8e8hJ:Tjor211BhwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1040-163-0x00000000008A0000-0x00000000008CA000-memory.dmp

Download

memory/1040-164-0x0000000005840000-0x0000000005E58000-memory.dmp

Download

memory/1040-165-0x0000000005340000-0x000000000544A000-memory.dmp

Download

memory/1040-166-0x0000000005270000-0x0000000005282000-memory.dmp

Download

memory/1040-167-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/1040-168-0x00000000052D0000-0x000000000530C000-memory.dmp

Download

memory/1040-170-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/1380-155-0x0000000000720000-0x000000000072A000-memory.dmp

Download