redline | bfdf2ff72fc38bd7cd4a31f63c9303428eddf931dd83f73e9ae35a29f1510027

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01593299.exe
Size 580KB
Sample230604-xj7cpsdb68
SHA256 bfdf2ff72fc38bd7cd4a31f63c9303428eddf931dd83f73e9ae35a29f1510027
MD5 a85b45743d54e7f1a0f281c4a446c5f1
SHA1 5248f066566c11dba274fe13f4bcee60f110074f
SHA512 d0e44311aa97bc83f352e9525fff1468ec67e3d461d8a5fcdc3f5206f955b320e6367a56974ee51509e9242bd7530041490435389174921ac6dd47fcde164253
SSDEEP 12288:vMr5y90YssQIUeSoEuZrHc3YNpqBQKtZj1tIhNEslLiGeL/A9:Cy5HfSVYvq3jM5iv/A9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k3765904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3765904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3765904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3765904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3765904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3765904.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4600	y1751898.exe
4300	y1007387.exe
1384	k3765904.exe
3392	l9770411.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3765904.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y1751898.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1751898.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y1007387.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1007387.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	01593299.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	01593299.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1384	k3765904.exe
1384	k3765904.exe
3392	l9770411.exe
3392	l9770411.exe
3392	l9770411.exe
3392	l9770411.exe
3392	l9770411.exe
3392	l9770411.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	k3765904.exe
Token: SeDebugPrivilege	3392	l9770411.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4600	4220	01593299.exe	84
PID 4220 wrote to memory of 4600	4220	01593299.exe	84
PID 4220 wrote to memory of 4600	4220	01593299.exe	84
PID 4600 wrote to memory of 4300	4600	y1751898.exe	85
PID 4600 wrote to memory of 4300	4600	y1751898.exe	85
PID 4600 wrote to memory of 4300	4600	y1751898.exe	85
PID 4300 wrote to memory of 1384	4300	y1007387.exe	86
PID 4300 wrote to memory of 1384	4300	y1007387.exe	86
PID 4300 wrote to memory of 3392	4300	y1007387.exe	87
PID 4300 wrote to memory of 3392	4300	y1007387.exe	87
PID 4300 wrote to memory of 3392	4300	y1007387.exe	87

C:\Users\Admin\AppData\Local\Temp\01593299.exe
"C:\Users\Admin\AppData\Local\Temp\01593299.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1751898.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1751898.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1007387.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1007387.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3765904.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3765904.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9770411.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9770411.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y1751898.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1751898.exe
Size 377KB
SHA256 1792ea03936a15f2f4b175711598ae770dff8ab53f759c2c9dc324b7e23b734f
MD5 b0640eff3a2078e9fd3fb2a9ccbe2a4f
SHA1 e55bd904cf66774a84d768df274cb727e0cde98c
SHA512 5d01627119db1d024e6d91cfd6828146cf0e0e8870de8786cbf56866b34a672604067666ac413a99a083b8f0f7d7f4c78f94e0b5b25746f7213825e2a54334ee
SSDEEP 6144:Khy+bnr+Ip0yN90QECFaaiPc76RlySq3YU+6Ske0nBlb5aAo7:jMrMy90rUQyr3YUIQldo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

y1751898.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1751898.exe
Size 377KB
SHA256 1792ea03936a15f2f4b175711598ae770dff8ab53f759c2c9dc324b7e23b734f
MD5 b0640eff3a2078e9fd3fb2a9ccbe2a4f
SHA1 e55bd904cf66774a84d768df274cb727e0cde98c
SHA512 5d01627119db1d024e6d91cfd6828146cf0e0e8870de8786cbf56866b34a672604067666ac413a99a083b8f0f7d7f4c78f94e0b5b25746f7213825e2a54334ee
SSDEEP 6144:Khy+bnr+Ip0yN90QECFaaiPc76RlySq3YU+6Ske0nBlb5aAo7:jMrMy90rUQyr3YUIQldo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

y1007387.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1007387.exe
Size 206KB
SHA256 1b8d86752733389f1924c8d8b47b59423f9b1927cd2822b41292b27deea2c7d5
MD5 ab1f4429a52478ca5f9ddbf1e58aad26
SHA1 1c8923f7df681e462037f223fa6cb746c955ab3d
SHA512 f3e0f3f4b10a28902f213d4350ef1ea894d0258e3b5e4780bf4e8ddaaaddd8f25dec5dfb8b1b87c3849896f9de58a5a2b3b3bb2c7677b67b7ec964a35e0084b5
SSDEEP 6144:Khy+bnr+wp0yN90QEOwGgfmBU9xeG6Tt7B:7Mr4y908wGgfmsxD6Jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

y1007387.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1007387.exe
Size 206KB
SHA256 1b8d86752733389f1924c8d8b47b59423f9b1927cd2822b41292b27deea2c7d5
MD5 ab1f4429a52478ca5f9ddbf1e58aad26
SHA1 1c8923f7df681e462037f223fa6cb746c955ab3d
SHA512 f3e0f3f4b10a28902f213d4350ef1ea894d0258e3b5e4780bf4e8ddaaaddd8f25dec5dfb8b1b87c3849896f9de58a5a2b3b3bb2c7677b67b7ec964a35e0084b5
SSDEEP 6144:Khy+bnr+wp0yN90QEOwGgfmBU9xeG6Tt7B:7Mr4y908wGgfmsxD6Jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

k3765904.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3765904.exe
Size 11KB
SHA256 4be32d617b16931119417e01f530854302983867caabcc28285e825d728114b3
MD5 da527e6a616ef975ffa3e1cc672fdbf8
SHA1 8d34896c55632475a928632f42d8f2e68ff9fdbe
SHA512 15fb158d6acb95f287f773e052d7e529b7fc96ca12449d48ab3e7b5acd6d4bbf28c15c2f0352fb0a84de66487f46a45d49c5804992e2e71728412b4d0eb72aeb
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k3765904.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3765904.exe
Size 11KB
SHA256 4be32d617b16931119417e01f530854302983867caabcc28285e825d728114b3
MD5 da527e6a616ef975ffa3e1cc672fdbf8
SHA1 8d34896c55632475a928632f42d8f2e68ff9fdbe
SHA512 15fb158d6acb95f287f773e052d7e529b7fc96ca12449d48ab3e7b5acd6d4bbf28c15c2f0352fb0a84de66487f46a45d49c5804992e2e71728412b4d0eb72aeb
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9770411.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9770411.exe
Size 172KB
SHA256 ff1676a57088cc16ee53a1cfcef73315fd4e7b6b3055c0626d371e819ded4b77
MD5 795e572992c5ce67a7eed82b2dd949b6
SHA1 8ca912d15402f49aaab1d91535761931615b7c02
SHA512 fa1d1216b40340de7bc91c16ca536d5d338c8dfbfbc8d8bc3226228b0ca6166f5cf268853811cc457c85b56cc8b4e16915fc6a5581ba466bed2f841a6db503ad
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9770411.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9770411.exe
Size 172KB
SHA256 ff1676a57088cc16ee53a1cfcef73315fd4e7b6b3055c0626d371e819ded4b77
MD5 795e572992c5ce67a7eed82b2dd949b6
SHA1 8ca912d15402f49aaab1d91535761931615b7c02
SHA512 fa1d1216b40340de7bc91c16ca536d5d338c8dfbfbc8d8bc3226228b0ca6166f5cf268853811cc457c85b56cc8b4e16915fc6a5581ba466bed2f841a6db503ad
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1384-154-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Download

memory/3392-160-0x000000000B390000-0x000000000B9A8000-memory.dmp

Download

memory/3392-166-0x000000000B280000-0x000000000B312000-memory.dmp

Download

memory/3392-161-0x000000000AEB0000-0x000000000AFBA000-memory.dmp

Download

memory/3392-162-0x000000000ADF0000-0x000000000AE02000-memory.dmp

Download

memory/3392-163-0x000000000AE50000-0x000000000AE8C000-memory.dmp

Download

memory/3392-164-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

memory/3392-165-0x000000000B160000-0x000000000B1D6000-memory.dmp

Download

memory/3392-159-0x0000000000F30000-0x0000000000F60000-memory.dmp

Download

memory/3392-167-0x000000000B1E0000-0x000000000B246000-memory.dmp

Download

memory/3392-168-0x000000000C360000-0x000000000C904000-memory.dmp

Download

memory/3392-169-0x000000000C190000-0x000000000C352000-memory.dmp

Download

memory/3392-170-0x000000000CE40000-0x000000000D36C000-memory.dmp

Download

memory/3392-171-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

memory/3392-172-0x000000000C090000-0x000000000C0E0000-memory.dmp

Download