redline | e289930a7b6af4628ed931cc6ba3f31503482f050a4e6243767cb953f1a0fdf9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02379999.exe
Size 580KB
Sample230604-xkrnmsdb79
SHA256 e289930a7b6af4628ed931cc6ba3f31503482f050a4e6243767cb953f1a0fdf9
MD5 f0420c2012ae95922532e9849dfdafa5
SHA1 e4aaa0211c37b7cc79af2167a3a9ebee9b52cd76
SHA512 151bfdfa705f73ce4114cd00d8aeee904a5a535339c5dd729baeca93eaa96e3de7d7be8a214bf48923b1d75d78def564232a4f95e610da3ccfb996af70f13666
SSDEEP 12288:6Mrqy90cMxIzwWnTcav2bpmUyB/tYLxMz44/tE5yqelWLxLP+PIPB30:syL8IUgczp/yBlY6z44W5yqelWLxLPEt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k1647775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1647775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1647775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1647775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1647775.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1647775.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1300	y6336647.exe
1316	y0019541.exe
3136	k1647775.exe
1680	l6093651.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1647775.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	02379999.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02379999.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6336647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6336647.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0019541.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0019541.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3136	k1647775.exe
3136	k1647775.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe
1680	l6093651.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	k1647775.exe
Token: SeDebugPrivilege	1680	l6093651.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1300	4912	02379999.exe	85
PID 4912 wrote to memory of 1300	4912	02379999.exe	85
PID 4912 wrote to memory of 1300	4912	02379999.exe	85
PID 1300 wrote to memory of 1316	1300	y6336647.exe	86
PID 1300 wrote to memory of 1316	1300	y6336647.exe	86
PID 1300 wrote to memory of 1316	1300	y6336647.exe	86
PID 1316 wrote to memory of 3136	1316	y0019541.exe	87
PID 1316 wrote to memory of 3136	1316	y0019541.exe	87
PID 1316 wrote to memory of 1680	1316	y0019541.exe	88
PID 1316 wrote to memory of 1680	1316	y0019541.exe	88
PID 1316 wrote to memory of 1680	1316	y0019541.exe	88

C:\Users\Admin\AppData\Local\Temp\02379999.exe
"C:\Users\Admin\AppData\Local\Temp\02379999.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6336647.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6336647.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0019541.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0019541.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1647775.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1647775.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6093651.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6093651.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y6336647.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6336647.exe
Size 377KB
SHA256 a151335a18f19ba6bbe77be4b364ce6c1bcb72988d29c247634087443776e489
MD5 1175b672b93112000735b55136114f13
SHA1 cb457489c24fcc26336b697d8919e71fa958f9a5
SHA512 8d8eb4cbd476d10dad36e3e75f10926a6e7fac3972aa0b56af8173e2c15e7970a7c43d8291d831545e7982ac3e65cbf60ec2e635cf2c1e2130a7928c3b7e4af8
SSDEEP 6144:KUy+bnr+ap0yN90QEOPWb6IVaHUr0tRM5UUyB/iGALS+ShPj4QDzP4jDrA5yTeP:AMriy90oWmSaHU+umUyB/iXLxwj4zjfs
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6336647.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6336647.exe
Size 377KB
SHA256 a151335a18f19ba6bbe77be4b364ce6c1bcb72988d29c247634087443776e489
MD5 1175b672b93112000735b55136114f13
SHA1 cb457489c24fcc26336b697d8919e71fa958f9a5
SHA512 8d8eb4cbd476d10dad36e3e75f10926a6e7fac3972aa0b56af8173e2c15e7970a7c43d8291d831545e7982ac3e65cbf60ec2e635cf2c1e2130a7928c3b7e4af8
SSDEEP 6144:KUy+bnr+ap0yN90QEOPWb6IVaHUr0tRM5UUyB/iGALS+ShPj4QDzP4jDrA5yTeP:AMriy90oWmSaHU+umUyB/iXLxwj4zjfs
MD5 SHA1 SHA512 SSDEEP

Submit Download

y0019541.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0019541.exe
Size 206KB
SHA256 6f428c85358add2711bfc5ed6a3d4651fe6e76bcc9f27d1fd5958136aec828fc
MD5 cf9ed2d3439323d7269194f7005ed35b
SHA1 28630def421c5a223ce428a7aed8eefffcad64d0
SHA512 4566c04c8213cfd83bd8e562eae23cd4c1ca6ff71c4ca964bd117853b7a5ddb8f6dfa07db96ab21e5b1f15be71d7de0df0faafd1f53d1cadee8dd2994b5a310f
SSDEEP 3072:K9y+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk1G8i+//sLD/O3vPk9qoZ:K9y+bnr+gp0yN90QEKi+/kv3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

y0019541.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0019541.exe
Size 206KB
SHA256 6f428c85358add2711bfc5ed6a3d4651fe6e76bcc9f27d1fd5958136aec828fc
MD5 cf9ed2d3439323d7269194f7005ed35b
SHA1 28630def421c5a223ce428a7aed8eefffcad64d0
SHA512 4566c04c8213cfd83bd8e562eae23cd4c1ca6ff71c4ca964bd117853b7a5ddb8f6dfa07db96ab21e5b1f15be71d7de0df0faafd1f53d1cadee8dd2994b5a310f
SSDEEP 3072:K9y+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk1G8i+//sLD/O3vPk9qoZ:K9y+bnr+gp0yN90QEKi+/kv3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1647775.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1647775.exe
Size 11KB
SHA256 7b240330a66ff49bac6e8f123ed69ee5f1c41b5db6479600eb779db9a734cd31
MD5 2154b674f244d75c338daae45fcb7e99
SHA1 75b5e21fde2bcebb0c521f417232ed50792feb34
SHA512 81bf7a749a103fefa8d5f83e243224ab2ae4351d884e51e09aa10e1c993d1341e7dee8bc5c4e5aa8ba9d6ca59a10ed70d2b8a2cba4977880839026cc8eec1703
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1647775.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1647775.exe
Size 11KB
SHA256 7b240330a66ff49bac6e8f123ed69ee5f1c41b5db6479600eb779db9a734cd31
MD5 2154b674f244d75c338daae45fcb7e99
SHA1 75b5e21fde2bcebb0c521f417232ed50792feb34
SHA512 81bf7a749a103fefa8d5f83e243224ab2ae4351d884e51e09aa10e1c993d1341e7dee8bc5c4e5aa8ba9d6ca59a10ed70d2b8a2cba4977880839026cc8eec1703
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l6093651.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6093651.exe
Size 172KB
SHA256 af87ee9d6b1d94cfce2dc03fdb7b3d1c2c188b55b4cdd68cc895c6d388a2e4ce
MD5 e09c66fe9f16484e08dcfee3dee2ae4b
SHA1 247203491f00a105f1c3b3dd9fd8af867e70e0a8
SHA512 8ab3dc3df20010132fb690201f5eb2636399c2455cf78b4297a5bdbd3f9d2216fa8a85bf7010b099c16bb6c7a2260588e0796ad2728ff630f3247a9b88af6933
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l6093651.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6093651.exe
Size 172KB
SHA256 af87ee9d6b1d94cfce2dc03fdb7b3d1c2c188b55b4cdd68cc895c6d388a2e4ce
MD5 e09c66fe9f16484e08dcfee3dee2ae4b
SHA1 247203491f00a105f1c3b3dd9fd8af867e70e0a8
SHA512 8ab3dc3df20010132fb690201f5eb2636399c2455cf78b4297a5bdbd3f9d2216fa8a85bf7010b099c16bb6c7a2260588e0796ad2728ff630f3247a9b88af6933
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-160-0x000000000AC00000-0x000000000B218000-memory.dmp

Download

memory/1680-165-0x000000000AA20000-0x000000000AA96000-memory.dmp

Download

memory/1680-172-0x0000000005150000-0x0000000005160000-memory.dmp

Download

memory/1680-161-0x000000000A770000-0x000000000A87A000-memory.dmp

Download

memory/1680-162-0x000000000A6B0000-0x000000000A6C2000-memory.dmp

Download

memory/1680-163-0x000000000A710000-0x000000000A74C000-memory.dmp

Download

memory/1680-164-0x0000000005150000-0x0000000005160000-memory.dmp

Download

memory/1680-159-0x00000000007F0000-0x0000000000820000-memory.dmp

Download

memory/1680-166-0x000000000AB40000-0x000000000ABD2000-memory.dmp

Download

memory/1680-167-0x000000000B7D0000-0x000000000BD74000-memory.dmp

Download

memory/1680-168-0x000000000B320000-0x000000000B386000-memory.dmp

Download

memory/1680-169-0x000000000B740000-0x000000000B790000-memory.dmp

Download

memory/1680-170-0x000000000BF50000-0x000000000C112000-memory.dmp

Download

memory/1680-171-0x000000000C650000-0x000000000CB7C000-memory.dmp

Download

memory/3136-154-0x0000000000520000-0x000000000052A000-memory.dmp

Download