redline | b229fa1cdeaafcc513d3e4de6c747fd261d470bd4199bf80eba93a36307557ab

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 580KB
Sample230605-af2aysec27
SHA256 b229fa1cdeaafcc513d3e4de6c747fd261d470bd4199bf80eba93a36307557ab
MD5 6f8bac169a3470998a02a88404e1d236
SHA1 09c5886cc0fc3aa8e84275bdc48f46a80b8c76da
SHA512 e486e4ecee1dcf7d69c4dfe25f3d4bdda8f52352aa7aa8b00161f5cea6fbb81224fe932b2ec5bc7806a5d199e340263e0e55355e2d1d071fe2bcdf3f5dab48d2
SSDEEP 12288:VMr+y90pTPHEGfqn9Tg/6Cf0U7hpsPRjZ1u2shAYkT:Py6DEkq9TSZft7hpJCY4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5506115.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5506115.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5506115.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5506115.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5506115.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5506115.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1532	y7893539.exe
1980	y6014799.exe
3224	k5506115.exe
3728	l4470545.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5506115.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7893539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7893539.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6014799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6014799.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3224	k5506115.exe
3224	k5506115.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe
3728	l4470545.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	k5506115.exe
Token: SeDebugPrivilege	3728	l4470545.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1532	5028	file.exe	82
PID 5028 wrote to memory of 1532	5028	file.exe	82
PID 5028 wrote to memory of 1532	5028	file.exe	82
PID 1532 wrote to memory of 1980	1532	y7893539.exe	83
PID 1532 wrote to memory of 1980	1532	y7893539.exe	83
PID 1532 wrote to memory of 1980	1532	y7893539.exe	83
PID 1980 wrote to memory of 3224	1980	y6014799.exe	84
PID 1980 wrote to memory of 3224	1980	y6014799.exe	84
PID 1980 wrote to memory of 3728	1980	y6014799.exe	85
PID 1980 wrote to memory of 3728	1980	y6014799.exe	85
PID 1980 wrote to memory of 3728	1980	y6014799.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7893539.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7893539.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6014799.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6014799.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506115.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506115.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4470545.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4470545.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y7893539.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7893539.exe
Size 377KB
SHA256 8cbb73c652f571eaa62c5eca0a5627b16f8eae137bc9a3038557fb232f9a6916
MD5 37b052d39c16a04cf153b32edcd47f12
SHA1 f8b6edbc289d8b1ec33dce1fdf7a0f6cd01229cc
SHA512 844411b0e595b472685b21fb3ea4a875be42f258d85d7715294b2fe01b727a7704c362697ac31b347a08e1276d089ecb7a7f1c4c41b1cd5c955d21ea2d559014
SSDEEP 6144:KDy+bnr+ip0yN90QEuvJsfMNuQu2s0guCM+/f+Ps1Brf0UwbhppSPY:JMrCy90wdNu92gk+/vTf0UKhpsPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7893539.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7893539.exe
Size 377KB
SHA256 8cbb73c652f571eaa62c5eca0a5627b16f8eae137bc9a3038557fb232f9a6916
MD5 37b052d39c16a04cf153b32edcd47f12
SHA1 f8b6edbc289d8b1ec33dce1fdf7a0f6cd01229cc
SHA512 844411b0e595b472685b21fb3ea4a875be42f258d85d7715294b2fe01b727a7704c362697ac31b347a08e1276d089ecb7a7f1c4c41b1cd5c955d21ea2d559014
SSDEEP 6144:KDy+bnr+ip0yN90QEuvJsfMNuQu2s0guCM+/f+Ps1Brf0UwbhppSPY:JMrCy90wdNu92gk+/vTf0UKhpsPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6014799.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6014799.exe
Size 206KB
SHA256 0e693140559975603aa2d49135aaae2f17172e76cd64ee02c2fac07ee2d9b1d4
MD5 882ad411a7d4b0c6014da6361e475516
SHA1 68e7006af8e0d1eae4769b906f5b262e321c2dbd
SHA512 ec5986619f2f59c133e4f25cc8e90c4d283d0fd0cb13369199f466344b4e458939f8ab916eab14ed1f1814d0572cfb79fcd63bec6b9603eb2bded7da6f03d4ba
SSDEEP 3072:KMy+bnr+O135GWp1icKAArDZz4N9GhbkrNEk1MPvCa3p8Ys6Dr9JSR6oe:KMy+bnr+kp0yN90QEdXCWNZDRJSRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6014799.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6014799.exe
Size 206KB
SHA256 0e693140559975603aa2d49135aaae2f17172e76cd64ee02c2fac07ee2d9b1d4
MD5 882ad411a7d4b0c6014da6361e475516
SHA1 68e7006af8e0d1eae4769b906f5b262e321c2dbd
SHA512 ec5986619f2f59c133e4f25cc8e90c4d283d0fd0cb13369199f466344b4e458939f8ab916eab14ed1f1814d0572cfb79fcd63bec6b9603eb2bded7da6f03d4ba
SSDEEP 3072:KMy+bnr+O135GWp1icKAArDZz4N9GhbkrNEk1MPvCa3p8Ys6Dr9JSR6oe:KMy+bnr+kp0yN90QEdXCWNZDRJSRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5506115.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506115.exe
Size 11KB
SHA256 096004dd32aef7ccff1e066266ea111a66d99932a3ece1920aa15f4cf5b5438c
MD5 e4ab14752d54e867226cba4b8e5d12c0
SHA1 f823ecebbedfdfbcecf7671804d86db308e27ac5
SHA512 4a4115596fd4ebf83ff3cd4fb0e01c60982d39a514628872a81b26282e7cf4687939e768cb8fdb60e7e2f41e9948f5dd70f8fae456bb6b7b50f41f55b82bdf53
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5506115.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5506115.exe
Size 11KB
SHA256 096004dd32aef7ccff1e066266ea111a66d99932a3ece1920aa15f4cf5b5438c
MD5 e4ab14752d54e867226cba4b8e5d12c0
SHA1 f823ecebbedfdfbcecf7671804d86db308e27ac5
SHA512 4a4115596fd4ebf83ff3cd4fb0e01c60982d39a514628872a81b26282e7cf4687939e768cb8fdb60e7e2f41e9948f5dd70f8fae456bb6b7b50f41f55b82bdf53
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l4470545.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4470545.exe
Size 172KB
SHA256 88f7b4e5959bf82a1b34a02117d2bbdb173b978e37d3cb3fdc196d4c8cc7c841
MD5 10182388d16edf81e337008c648e43bb
SHA1 5196338f0f73eab910251c7da4533e0764c60904
SHA512 6c24bf3183f13d41f0abd9900eb81819aca265edcb8e14eadf2b395ce9ccb961830960d7d63698e9caf181eb3eb7f4c1db6f43628c73705ee52d2483affad9ff
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l4470545.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4470545.exe
Size 172KB
SHA256 88f7b4e5959bf82a1b34a02117d2bbdb173b978e37d3cb3fdc196d4c8cc7c841
MD5 10182388d16edf81e337008c648e43bb
SHA1 5196338f0f73eab910251c7da4533e0764c60904
SHA512 6c24bf3183f13d41f0abd9900eb81819aca265edcb8e14eadf2b395ce9ccb961830960d7d63698e9caf181eb3eb7f4c1db6f43628c73705ee52d2483affad9ff
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3224-154-0x0000000000900000-0x000000000090A000-memory.dmp

Download

memory/3728-161-0x000000000B090000-0x000000000B6A8000-memory.dmp

Download

memory/3728-167-0x000000000B880000-0x000000000B8F6000-memory.dmp

Download

memory/3728-162-0x000000000AC10000-0x000000000AD1A000-memory.dmp

Download

memory/3728-163-0x000000000AB50000-0x000000000AB62000-memory.dmp

Download

memory/3728-164-0x000000000ABB0000-0x000000000ABEC000-memory.dmp

Download

memory/3728-165-0x0000000002F80000-0x0000000002F90000-memory.dmp

Download

memory/3728-166-0x0000000002F80000-0x0000000002F90000-memory.dmp

Download

memory/3728-160-0x0000000000DD0000-0x0000000000E00000-memory.dmp

Download

memory/3728-168-0x000000000B9A0000-0x000000000BA32000-memory.dmp

Download

memory/3728-169-0x000000000B900000-0x000000000B966000-memory.dmp

Download

memory/3728-170-0x000000000C0F0000-0x000000000C694000-memory.dmp

Download

memory/3728-171-0x000000000BDD0000-0x000000000BF92000-memory.dmp

Download

memory/3728-172-0x000000000CBD0000-0x000000000D0FC000-memory.dmp

Download

memory/3728-173-0x000000000BFF0000-0x000000000C040000-memory.dmp

Download