redline | 8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a

General

Target

8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe
Size

581KB
MD5

6560bed16b08cded56ce752faf6fe3f5
SHA1

8a5dd68bca634b6cb13ce178daf5b56e250a86ec
SHA256

8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a
SHA512

7cd65b99e26a2cf6a1c12ebf9f2439659c4daba611f70d8a26a5e383f6b4b05a41831bae9aeb55fcc991f6abcd041b66ff1a51545e3aa60380f51af8096ba79c
SSDEEP

12288:kMrQy90jC22Ty+lXfGUKQ5idqUu5+UQkwZyxkIKOm3irqe1w:EysC22O+NiQ5idqh5+/RyxkItImw

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a5810996.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5810996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5810996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5810996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5810996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5810996.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v9168170.exev8491655.exea5810996.exeb3068683.exe

pid process

2544 v9168170.exe
2604 v8491655.exe
4372 a5810996.exe
4488 b3068683.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a5810996.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a5810996.exe

pid	process
2544	v9168170.exe
2604	v8491655.exe
4372	a5810996.exe
4488	b3068683.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5810996.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v8491655.exe8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exev9168170.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8491655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8491655.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9168170.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9168170.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

a5810996.exeb3068683.exe

pid	process
4372	a5810996.exe
4372	a5810996.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe
4488	b3068683.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a5810996.exeb3068683.exe

description pid process

Token: SeDebugPrivilege 4372 a5810996.exe
Token: SeDebugPrivilege 4488 b3068683.exe

description	pid	process
Token: SeDebugPrivilege	4372	a5810996.exe
Token: SeDebugPrivilege	4488	b3068683.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exev9168170.exev8491655.exe

description	pid	process	target process
PID 2504 wrote to memory of 2544	2504	8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe	v9168170.exe
PID 2504 wrote to memory of 2544	2504	8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe	v9168170.exe
PID 2504 wrote to memory of 2544	2504	8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe	v9168170.exe
PID 2544 wrote to memory of 2604	2544	v9168170.exe	v8491655.exe
PID 2544 wrote to memory of 2604	2544	v9168170.exe	v8491655.exe
PID 2544 wrote to memory of 2604	2544	v9168170.exe	v8491655.exe
PID 2604 wrote to memory of 4372	2604	v8491655.exe	a5810996.exe
PID 2604 wrote to memory of 4372	2604	v8491655.exe	a5810996.exe
PID 2604 wrote to memory of 4488	2604	v8491655.exe	b3068683.exe
PID 2604 wrote to memory of 4488	2604	v8491655.exe	b3068683.exe
PID 2604 wrote to memory of 4488	2604	v8491655.exe	b3068683.exe

C:\Users\Admin\AppData\Local\Temp\8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe
"C:\Users\Admin\AppData\Local\Temp\8813d877e540af879fef25d3f1886d4b2d109b10ffe67a90751d4be19770620a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2504

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9168170.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9168170.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8491655.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8491655.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5810996.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5810996.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3068683.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3068683.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9168170.exe
Filesize
377KB

MD5
aba739e4c7744f195ef6a0ade7fcea41

SHA1
0da08c871d9dbf11a485ea4eb5330cb90a7f157e

SHA256
e36cd28a47896e38737e443be753829b03c0e6709e04af0fe583e1ad7e246772

SHA512
39d29fc4e2998dafb0c44cb66cf4a7034725f80d7811a0b613f66413d121ffff5d6794be6b7124591f66f219b6fc74b8a193572a2fbb20f8af10ee8d4f040bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9168170.exe
Filesize
377KB

MD5
aba739e4c7744f195ef6a0ade7fcea41

SHA1
0da08c871d9dbf11a485ea4eb5330cb90a7f157e

SHA256
e36cd28a47896e38737e443be753829b03c0e6709e04af0fe583e1ad7e246772

SHA512
39d29fc4e2998dafb0c44cb66cf4a7034725f80d7811a0b613f66413d121ffff5d6794be6b7124591f66f219b6fc74b8a193572a2fbb20f8af10ee8d4f040bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8491655.exe
Filesize
206KB

MD5
4430161450c7d70caa0b096cda5ef189

SHA1
2c8ceab92d1ea3e344cd153c9cb6898d0a914bda

SHA256
162ddbc832891ffe79767f16843fca6f0d908081682e6ee8be7bd7d76eec8f4d

SHA512
be2b77c809e652862eb9d19e65cccc9793ef3975c2c137d7bb5c260ae35860dd791ff688b564a5ec0a463e3b7c9087bf473c9206670b21172926db200e5481d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8491655.exe
Filesize
206KB

MD5
4430161450c7d70caa0b096cda5ef189

SHA1
2c8ceab92d1ea3e344cd153c9cb6898d0a914bda

SHA256
162ddbc832891ffe79767f16843fca6f0d908081682e6ee8be7bd7d76eec8f4d

SHA512
be2b77c809e652862eb9d19e65cccc9793ef3975c2c137d7bb5c260ae35860dd791ff688b564a5ec0a463e3b7c9087bf473c9206670b21172926db200e5481d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5810996.exe
Filesize
11KB

MD5
c0d906a1ffda7971fda2303da0cd76f9

SHA1
3fef2e6bcc3f8139771bcdfd2ea35fc1ae2bc1d2

SHA256
c643df1b9191347f705af74edcc094e276b349467045b37fa9abd33d574ce6fa

SHA512
349d16a5d0547d8917ebf7489fba4505abe607a53bc548a8e1e3feb2c26bd46f5e5d903c6cf4dae557ab5b8dd8d599640e350366531b0029463f36a5a17026e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5810996.exe
Filesize
11KB

MD5
c0d906a1ffda7971fda2303da0cd76f9

SHA1
3fef2e6bcc3f8139771bcdfd2ea35fc1ae2bc1d2

SHA256
c643df1b9191347f705af74edcc094e276b349467045b37fa9abd33d574ce6fa

SHA512
349d16a5d0547d8917ebf7489fba4505abe607a53bc548a8e1e3feb2c26bd46f5e5d903c6cf4dae557ab5b8dd8d599640e350366531b0029463f36a5a17026e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3068683.exe
Filesize
172KB

MD5
94f10afa685d2ab7b64b0244cdc131db

SHA1
404b7d33a4a976c8abb14f8e7fa77b2996be4e9c

SHA256
f415cd685d0eb9b6e54ef5df5c5a4c9634c993bd942d18e385d56f4db979c45a

SHA512
e4d6b06e6a4c44d7f99fb4be3ce5a6fdedb440f2878ad9742863e07d186ee70f73366380bc334580c59be0fbbb120c959efae0406fc343870db95c620fa3beff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3068683.exe
Filesize
172KB

MD5
94f10afa685d2ab7b64b0244cdc131db

SHA1
404b7d33a4a976c8abb14f8e7fa77b2996be4e9c

SHA256
f415cd685d0eb9b6e54ef5df5c5a4c9634c993bd942d18e385d56f4db979c45a

SHA512
e4d6b06e6a4c44d7f99fb4be3ce5a6fdedb440f2878ad9742863e07d186ee70f73366380bc334580c59be0fbbb120c959efae0406fc343870db95c620fa3beff

Download Submit
memory/4372-142-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

Filesize
40KB

Download
memory/4488-150-0x000000000A020000-0x000000000A12A000-memory.dmp

Filesize
1.0MB

Download
memory/4488-154-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4488-149-0x000000000A500000-0x000000000AB06000-memory.dmp

Filesize
6.0MB

Download
memory/4488-147-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/4488-151-0x0000000009F50000-0x0000000009F62000-memory.dmp

Filesize
72KB

Download
memory/4488-152-0x0000000009FB0000-0x0000000009FEE000-memory.dmp

Filesize
248KB

Download
memory/4488-153-0x000000000A130000-0x000000000A17B000-memory.dmp

Filesize
300KB

Download
memory/4488-148-0x00000000049D0000-0x00000000049D6000-memory.dmp

Filesize
24KB

Download
memory/4488-155-0x000000000A2D0000-0x000000000A346000-memory.dmp

Filesize
472KB

Download
memory/4488-156-0x000000000A3F0000-0x000000000A482000-memory.dmp

Filesize
584KB

Download
memory/4488-157-0x000000000B010000-0x000000000B50E000-memory.dmp

Filesize
5.0MB

Download
memory/4488-158-0x000000000AB10000-0x000000000AB76000-memory.dmp

Filesize
408KB

Download
memory/4488-159-0x000000000B7E0000-0x000000000B9A2000-memory.dmp

Filesize
1.8MB

Download
memory/4488-160-0x000000000BEE0000-0x000000000C40C000-memory.dmp

Filesize
5.2MB

Download
memory/4488-161-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4488-162-0x000000000B6C0000-0x000000000B710000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads