redline | cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2

General

Target

cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe
Size

628KB
MD5

0e365d81ba1fc6b36873aec3e28b8055
SHA1

a7973409cd766b6b1de27d310ef4e6c5666c3d47
SHA256

cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2
SHA512

bbddf3de494ab1866796522e99eaa145723cb297c7bc102e6d2f9092002e30ef3dd7fb513d003dfc08f34b4ab617a4470c915fa0a13f1c868e3bff320467d2a5
SSDEEP

12288:nMrvy90AOdMaQ3lXrFf4Mm5J3IVqSqCxB6kbCR39O5f/LNpHN+CDij:0yKQ3xx83Mvqo81wRP+CDij

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2828	y9638147.exe
800	y0595583.exe
4052	k7696076.exe
4528	l0365920.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9638147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9638147.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0595583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0595583.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 3004	4052	k7696076.exe	91

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3004	AppLaunch.exe
3004	AppLaunch.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe
4528	l0365920.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	AppLaunch.exe
Token: SeDebugPrivilege	4528	l0365920.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2828	536	cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe	87
PID 536 wrote to memory of 2828	536	cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe	87
PID 536 wrote to memory of 2828	536	cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe	87
PID 2828 wrote to memory of 800	2828	y9638147.exe	88
PID 2828 wrote to memory of 800	2828	y9638147.exe	88
PID 2828 wrote to memory of 800	2828	y9638147.exe	88
PID 800 wrote to memory of 4052	800	y0595583.exe	89
PID 800 wrote to memory of 4052	800	y0595583.exe	89
PID 800 wrote to memory of 4052	800	y0595583.exe	89
PID 4052 wrote to memory of 3004	4052	k7696076.exe	91
PID 4052 wrote to memory of 3004	4052	k7696076.exe	91
PID 4052 wrote to memory of 3004	4052	k7696076.exe	91
PID 4052 wrote to memory of 3004	4052	k7696076.exe	91
PID 4052 wrote to memory of 3004	4052	k7696076.exe	91
PID 800 wrote to memory of 4528	800	y0595583.exe	92
PID 800 wrote to memory of 4528	800	y0595583.exe	92
PID 800 wrote to memory of 4528	800	y0595583.exe	92

C:\Users\Admin\AppData\Local\Temp\cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe
"C:\Users\Admin\AppData\Local\Temp\cb64db45db9439dbcc3bc7e4e99188c9ddfebab22eb919e105f273f48b32dac2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9638147.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9638147.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0595583.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0595583.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7696076.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7696076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0365920.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0365920.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9638147.exe

Filesize
426KB

MD5
58a898c4ebb7b82f46a7ff36a6bec8e3

SHA1
7971a820ebcfeeb2ee22248f5f8e7e932b4b658a

SHA256
c0a900b77ce25297aa4c5bf0a59147805127e5c1ca5c2f0e5d3a2cf8000fc3fe

SHA512
b3ce1577e20e68b9c38da8bb5be358814bda1f22cbc03937d70cf3ec98fcb032410a659e573399402781d20b45dd61b8678208466a9e5870523c4453efa6c45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9638147.exe

Filesize
426KB

MD5
58a898c4ebb7b82f46a7ff36a6bec8e3

SHA1
7971a820ebcfeeb2ee22248f5f8e7e932b4b658a

SHA256
c0a900b77ce25297aa4c5bf0a59147805127e5c1ca5c2f0e5d3a2cf8000fc3fe

SHA512
b3ce1577e20e68b9c38da8bb5be358814bda1f22cbc03937d70cf3ec98fcb032410a659e573399402781d20b45dd61b8678208466a9e5870523c4453efa6c45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0595583.exe

Filesize
254KB

MD5
8f3d9713c9b79f8e3faa8a719d6c893f

SHA1
30466617efeb5bfe317b75277106f1da5e8a95a1

SHA256
c4abbd728bd2c5dbbed9190549f43966e231f1ea3f6199534aa4ddb90635cf84

SHA512
afd708a4d7b96ebaaffc92670dceade8e37d3a939d9ff8dbda837a558302d4e2bd02a4b2d1ca9d0391750f4c9b2cf73540632b3b8c91f994a2c7509999cf6088

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0595583.exe

Filesize
254KB

MD5
8f3d9713c9b79f8e3faa8a719d6c893f

SHA1
30466617efeb5bfe317b75277106f1da5e8a95a1

SHA256
c4abbd728bd2c5dbbed9190549f43966e231f1ea3f6199534aa4ddb90635cf84

SHA512
afd708a4d7b96ebaaffc92670dceade8e37d3a939d9ff8dbda837a558302d4e2bd02a4b2d1ca9d0391750f4c9b2cf73540632b3b8c91f994a2c7509999cf6088

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7696076.exe

Filesize
108KB

MD5
7a81d41f2a10497ceebbbc4655a96e7b

SHA1
af2a20c7df24bac1d33077d05b4a98cd6ecf35f1

SHA256
fa31ede220d6e180c4c6ba235a0ebd9dab5b3d21cd4e38dd86a300ad94386ef1

SHA512
daa2372854f20c1cbff86f247589cf79eb9caed2fe9f1c7832d5250b79bb3b4f603e77a9032021774adcabd01bf2cbd8095389e368c8b66857633ed11087f2e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7696076.exe

Filesize
108KB

MD5
7a81d41f2a10497ceebbbc4655a96e7b

SHA1
af2a20c7df24bac1d33077d05b4a98cd6ecf35f1

SHA256
fa31ede220d6e180c4c6ba235a0ebd9dab5b3d21cd4e38dd86a300ad94386ef1

SHA512
daa2372854f20c1cbff86f247589cf79eb9caed2fe9f1c7832d5250b79bb3b4f603e77a9032021774adcabd01bf2cbd8095389e368c8b66857633ed11087f2e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0365920.exe

Filesize
172KB

MD5
f04fbd35c80a64ee3dc6ded9c3435b84

SHA1
11e9212b52e6625e61c0562d1c6de97c94caeaeb

SHA256
e84730f3fd61cfd642f4017c41cfc64371c47625ca7d6a4bcf02b402484026a4

SHA512
8da794b7df383af3b8ff1b5f2153df77f31cdb2b82e720aa2fc82adbf99fd470d8b8ccaa92efd6b4a6343d522c41f98c807677cc9b6bf1dd8f9b1c08d0fb5d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0365920.exe

Filesize
172KB

MD5
f04fbd35c80a64ee3dc6ded9c3435b84

SHA1
11e9212b52e6625e61c0562d1c6de97c94caeaeb

SHA256
e84730f3fd61cfd642f4017c41cfc64371c47625ca7d6a4bcf02b402484026a4

SHA512
8da794b7df383af3b8ff1b5f2153df77f31cdb2b82e720aa2fc82adbf99fd470d8b8ccaa92efd6b4a6343d522c41f98c807677cc9b6bf1dd8f9b1c08d0fb5d6c

Download Submit
memory/3004-154-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4528-163-0x000000000A730000-0x000000000AD48000-memory.dmp

Filesize
6.1MB

Download
memory/4528-169-0x000000000AD50000-0x000000000ADE2000-memory.dmp

Filesize
584KB

Download
memory/4528-164-0x000000000A220000-0x000000000A32A000-memory.dmp

Filesize
1.0MB

Download
memory/4528-165-0x000000000A130000-0x000000000A142000-memory.dmp

Filesize
72KB

Download
memory/4528-166-0x000000000A190000-0x000000000A1CC000-memory.dmp

Filesize
240KB

Download
memory/4528-167-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4528-168-0x000000000A5A0000-0x000000000A616000-memory.dmp

Filesize
472KB

Download
memory/4528-162-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download
memory/4528-170-0x000000000B3A0000-0x000000000B944000-memory.dmp

Filesize
5.6MB

Download
memory/4528-171-0x000000000ADF0000-0x000000000AE56000-memory.dmp

Filesize
408KB

Download
memory/4528-172-0x000000000BB20000-0x000000000BCE2000-memory.dmp

Filesize
1.8MB

Download
memory/4528-173-0x000000000C220000-0x000000000C74C000-memory.dmp

Filesize
5.2MB

Download
memory/4528-175-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/4528-176-0x000000000B9A0000-0x000000000B9F0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads