redline | 627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857

General

Target

627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe
Size

581KB
MD5

ebea96776bb04d1d0318f0630fda1537
SHA1

9761f9d24bb96ebc59ba883d7b22624d33ba1358
SHA256

627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857
SHA512

e80a90c10ed3c36ee502768f7bd4c78e2dec3ae467fc441d837f6aa2e62ea10c03423d9b3b7a3a7591cd838ae0ab3a7e19d1e556acb5ed837de668fdd28f0efb
SSDEEP

12288:hMrPy90Lj+xtfMyYu3ov1MNT0+DdpK9xJkPdA+:eyCQfMy73oP+Ddpb1v

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a4370947.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a4370947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4370947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4370947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4370947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4370947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4370947.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v5634825.exev4329087.exea4370947.exeb3354470.exe

pid process

2888 v5634825.exe
2020 v4329087.exe
4288 a4370947.exe
4180 b3354470.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a4370947.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a4370947.exe

pid	process
2888	v5634825.exe
2020	v4329087.exe
4288	a4370947.exe
4180	b3354470.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4370947.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exev5634825.exev4329087.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5634825.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5634825.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4329087.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4329087.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

a4370947.exeb3354470.exe

pid	process
4288	a4370947.exe
4288	a4370947.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe
4180	b3354470.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a4370947.exeb3354470.exe

description pid process

Token: SeDebugPrivilege 4288 a4370947.exe
Token: SeDebugPrivilege 4180 b3354470.exe

description	pid	process
Token: SeDebugPrivilege	4288	a4370947.exe
Token: SeDebugPrivilege	4180	b3354470.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exev5634825.exev4329087.exe

description	pid	process	target process
PID 2672 wrote to memory of 2888	2672	627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe	v5634825.exe
PID 2672 wrote to memory of 2888	2672	627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe	v5634825.exe
PID 2672 wrote to memory of 2888	2672	627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe	v5634825.exe
PID 2888 wrote to memory of 2020	2888	v5634825.exe	v4329087.exe
PID 2888 wrote to memory of 2020	2888	v5634825.exe	v4329087.exe
PID 2888 wrote to memory of 2020	2888	v5634825.exe	v4329087.exe
PID 2020 wrote to memory of 4288	2020	v4329087.exe	a4370947.exe
PID 2020 wrote to memory of 4288	2020	v4329087.exe	a4370947.exe
PID 2020 wrote to memory of 4180	2020	v4329087.exe	b3354470.exe
PID 2020 wrote to memory of 4180	2020	v4329087.exe	b3354470.exe
PID 2020 wrote to memory of 4180	2020	v4329087.exe	b3354470.exe

C:\Users\Admin\AppData\Local\Temp\627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe
"C:\Users\Admin\AppData\Local\Temp\627bca92413edc5f0e26eda27d0d86ca2d2800bb3249d0d31b28cd4e22df7857.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5634825.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5634825.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4329087.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4329087.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4370947.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4370947.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3354470.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3354470.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5634825.exe

Filesize
377KB

MD5
bfd50a0a6a0b5ef1af6b805945ab35a0

SHA1
1c373e6cee9c2f42c345ab11ef75853b26bd15f0

SHA256
84bcc98e224ff3d20dcdec5fb5c4ea14ceb951b0bc370f0b4dcd1adc7dbfe890

SHA512
12f3514f3f78d595970580fc641a1a5692bb4b2a6963c63e37be19a8a67b4c749a808516a19909d3396812467d3ae27b6c0622e6bc4084b756e378a25b498469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5634825.exe

Filesize
377KB

MD5
bfd50a0a6a0b5ef1af6b805945ab35a0

SHA1
1c373e6cee9c2f42c345ab11ef75853b26bd15f0

SHA256
84bcc98e224ff3d20dcdec5fb5c4ea14ceb951b0bc370f0b4dcd1adc7dbfe890

SHA512
12f3514f3f78d595970580fc641a1a5692bb4b2a6963c63e37be19a8a67b4c749a808516a19909d3396812467d3ae27b6c0622e6bc4084b756e378a25b498469

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4329087.exe

Filesize
206KB

MD5
3b576101b47c7283fb2300fa81aa3e2f

SHA1
7145fbbfee189f2ce4e05e9684d14f97ffb298e7

SHA256
3f611f37dab16f68586b8c802471418495e3889f16c1b3a9c7c8128b87d02256

SHA512
f45e87d22bedd4ec236f93ff52e5f7ac651e85912df3c99a38a8963cda854ea9b535b776ed7a1a9bb98b6bf2e8d42cef98f60e06f11ba9061847f4eecba8e0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4329087.exe

Filesize
206KB

MD5
3b576101b47c7283fb2300fa81aa3e2f

SHA1
7145fbbfee189f2ce4e05e9684d14f97ffb298e7

SHA256
3f611f37dab16f68586b8c802471418495e3889f16c1b3a9c7c8128b87d02256

SHA512
f45e87d22bedd4ec236f93ff52e5f7ac651e85912df3c99a38a8963cda854ea9b535b776ed7a1a9bb98b6bf2e8d42cef98f60e06f11ba9061847f4eecba8e0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4370947.exe

Filesize
11KB

MD5
fa9bbd1cf1d0202ee547cfb8ca5a1a2f

SHA1
7a62cfc2dac6bc29843eb1fd0f1ed72d90134bd9

SHA256
32d68f3792182c04cb7abd4aeb41dd9e00d0db8207e382df3937964590dc51af

SHA512
d017dfd0a29713540ae7a3ef31ca9bac78e3ca68fb7d3cce2e9d082d1a820b68163773ef5bd0604bb58100d58764d07bea5281ef3d2f466cce32c015fb1c717c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4370947.exe

Filesize
11KB

MD5
fa9bbd1cf1d0202ee547cfb8ca5a1a2f

SHA1
7a62cfc2dac6bc29843eb1fd0f1ed72d90134bd9

SHA256
32d68f3792182c04cb7abd4aeb41dd9e00d0db8207e382df3937964590dc51af

SHA512
d017dfd0a29713540ae7a3ef31ca9bac78e3ca68fb7d3cce2e9d082d1a820b68163773ef5bd0604bb58100d58764d07bea5281ef3d2f466cce32c015fb1c717c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3354470.exe

Filesize
172KB

MD5
57ea65a2fc5cd0ce65bf6fed1375d39a

SHA1
012b897de3d5ff623ff7a14e22c30023868b3769

SHA256
441c8d59f55e227c3630917318398a576f841451ee05a6ebe2e78c5533b1a9e4

SHA512
3d42448167967094416364fab18e8d670ac22b0eb979178d194b794d3bd24d9086090e5a43823cc26c6ed1bd3d773a1ce0e91137d3b536518791fd826d1bf6de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3354470.exe

Filesize
172KB

MD5
57ea65a2fc5cd0ce65bf6fed1375d39a

SHA1
012b897de3d5ff623ff7a14e22c30023868b3769

SHA256
441c8d59f55e227c3630917318398a576f841451ee05a6ebe2e78c5533b1a9e4

SHA512
3d42448167967094416364fab18e8d670ac22b0eb979178d194b794d3bd24d9086090e5a43823cc26c6ed1bd3d773a1ce0e91137d3b536518791fd826d1bf6de

Download Submit
memory/4180-160-0x000000000AC00000-0x000000000B218000-memory.dmp

Filesize
6.1MB

Download
memory/4180-165-0x000000000AAB0000-0x000000000AB26000-memory.dmp

Filesize
472KB

Download
memory/4180-172-0x000000000BEB0000-0x000000000BF00000-memory.dmp

Filesize
320KB

Download
memory/4180-161-0x000000000A700000-0x000000000A80A000-memory.dmp

Filesize
1.0MB

Download
memory/4180-162-0x000000000A640000-0x000000000A652000-memory.dmp

Filesize
72KB

Download
memory/4180-163-0x000000000A6A0000-0x000000000A6DC000-memory.dmp

Filesize
240KB

Download
memory/4180-164-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/4180-159-0x0000000000780000-0x00000000007B0000-memory.dmp

Filesize
192KB

Download
memory/4180-166-0x000000000B220000-0x000000000B2B2000-memory.dmp

Filesize
584KB

Download
memory/4180-167-0x000000000B870000-0x000000000BE14000-memory.dmp

Filesize
5.6MB

Download
memory/4180-168-0x000000000B330000-0x000000000B396000-memory.dmp

Filesize
408KB

Download
memory/4180-169-0x000000000BFF0000-0x000000000C1B2000-memory.dmp

Filesize
1.8MB

Download
memory/4180-170-0x000000000C6F0000-0x000000000CC1C000-memory.dmp

Filesize
5.2MB

Download
memory/4180-171-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/4288-154-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads