redline | f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 580KB
Sample230605-agllwsec29
SHA256 f400406675e078e6465430676ab8efc736fe42d52d38fb02c7829840d301e317
MD5 3d33cc4a4007bf7d7e26dae656fab795
SHA1 e908a0268e62aa3cbc70fb40276eccde98455106
SHA512 67e5f38d74a6bdbfcec27519ac441cd576d8537fdc31d52876aedd5c8f415ce042e10b4d45e7bc24c31963f0afcc7c508ac2de5a3991a6aa4a400b44faf9b7b9
SSDEEP 12288:aMrWy90/gB9v1iFA7j8cZMdxSTjRGBsD7FKWvUkxxJI3ZB:MylNSi8cydANGBiAWFxx4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5581629.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5581629.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5581629.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5581629.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5581629.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a5581629.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4272	v4640148.exe
3516	v5539219.exe
4840	a5581629.exe
4764	b8421290.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5581629.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4640148.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4640148.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5539219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5539219.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4840	a5581629.exe
4840	a5581629.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe
4764	b8421290.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	a5581629.exe
Token: SeDebugPrivilege	4764	b8421290.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4272	1584	file.exe	84
PID 1584 wrote to memory of 4272	1584	file.exe	84
PID 1584 wrote to memory of 4272	1584	file.exe	84
PID 4272 wrote to memory of 3516	4272	v4640148.exe	85
PID 4272 wrote to memory of 3516	4272	v4640148.exe	85
PID 4272 wrote to memory of 3516	4272	v4640148.exe	85
PID 3516 wrote to memory of 4840	3516	v5539219.exe	86
PID 3516 wrote to memory of 4840	3516	v5539219.exe	86
PID 3516 wrote to memory of 4764	3516	v5539219.exe	87
PID 3516 wrote to memory of 4764	3516	v5539219.exe	87
PID 3516 wrote to memory of 4764	3516	v5539219.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v4640148.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exe
Size 378KB
SHA256 e9a223064eb629045c3df2be145cb4e4b87aa4612bb9f516bfab57000b5ed73b
MD5 08310e1252404cb9eb0c95405916b4e6
SHA1 a2e753db164b1064f92753ebe43f00cdda5faddb
SHA512 5d8f9f6ed2aed8d18be191aa1cb69c91fdfc43f8b9f98a0da6f76287276f82ac5682f8fd0ace0ea51631efdb0321c4aa205cc9adb4e012e21bc3a0b29d4dc6a1
SSDEEP 6144:KAy+bnr+Lp0yN90QEhYoXbOESFZjJcikcxB4xyxvnD7jTyR8L:4MrLy90zY8yESTjH8sfD7qKL
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4640148.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4640148.exe
Size 378KB
SHA256 e9a223064eb629045c3df2be145cb4e4b87aa4612bb9f516bfab57000b5ed73b
MD5 08310e1252404cb9eb0c95405916b4e6
SHA1 a2e753db164b1064f92753ebe43f00cdda5faddb
SHA512 5d8f9f6ed2aed8d18be191aa1cb69c91fdfc43f8b9f98a0da6f76287276f82ac5682f8fd0ace0ea51631efdb0321c4aa205cc9adb4e012e21bc3a0b29d4dc6a1
SSDEEP 6144:KAy+bnr+Lp0yN90QEhYoXbOESFZjJcikcxB4xyxvnD7jTyR8L:4MrLy90zY8yESTjH8sfD7qKL
MD5 SHA1 SHA512 SSDEEP

Submit Download

v5539219.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exe
Size 206KB
SHA256 b3116bcb09056ee96110b042701d78450dac078a8e0383a70b0a5aff4f8309e4
MD5 1a59af8cfe51430ba3232b6440be2258
SHA1 45981b180827d80e9461c6127e0c4732819c4379
SHA512 827219098cc9c702f719b28fb95bdd0a21d12f4ae50e53434dfb2dd32ac6f7432da58cb03c30942111672e84fdb0ae3bda2d1596de5fdc0c932f474b0ca0b724
SSDEEP 3072:Kmy+bnr+O1E5GWp1icKAArDZz4N9GhbkrNEk1zj7pBf0UOqKzmG6plWov:Kmy+bnr+fp0yN90QEmV50tqKCG67R
MD5 SHA1 SHA512 SSDEEP

Submit Download

v5539219.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5539219.exe
Size 206KB
SHA256 b3116bcb09056ee96110b042701d78450dac078a8e0383a70b0a5aff4f8309e4
MD5 1a59af8cfe51430ba3232b6440be2258
SHA1 45981b180827d80e9461c6127e0c4732819c4379
SHA512 827219098cc9c702f719b28fb95bdd0a21d12f4ae50e53434dfb2dd32ac6f7432da58cb03c30942111672e84fdb0ae3bda2d1596de5fdc0c932f474b0ca0b724
SSDEEP 3072:Kmy+bnr+O1E5GWp1icKAArDZz4N9GhbkrNEk1zj7pBf0UOqKzmG6plWov:Kmy+bnr+fp0yN90QEmV50tqKCG67R
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5581629.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exe
Size 11KB
SHA256 bfaddfa17ef956d9ff60aa9a7e934ceb72aaa5d3fa44f25301dc311cb84f7062
MD5 7718786682a8337d7648a66452f38451
SHA1 8c920f18fcba96bf298b6b4fedc106d41bffc15d
SHA512 3b5ebf59a31776f85d2c69d054e67e39643b0953501149559892a09281470458ffbb1791a954b846289490b940e766a573804711fece9c66e1fd496ba1e59106
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5581629.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5581629.exe
Size 11KB
SHA256 bfaddfa17ef956d9ff60aa9a7e934ceb72aaa5d3fa44f25301dc311cb84f7062
MD5 7718786682a8337d7648a66452f38451
SHA1 8c920f18fcba96bf298b6b4fedc106d41bffc15d
SHA512 3b5ebf59a31776f85d2c69d054e67e39643b0953501149559892a09281470458ffbb1791a954b846289490b940e766a573804711fece9c66e1fd496ba1e59106
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8421290.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exe
Size 172KB
SHA256 b6756eac7497c8eaf1f8d0d8860e84ed6c4204a3c061367ea4304c641e2f68f0
MD5 30aa28ce8fe7e0306c6c23f43a8188be
SHA1 c5e75ac0d08b223833df143725f403b2f5ad518b
SHA512 d3b2f2bda8634daf0e1f98ece78e4aefc40ac2d644cdef9ee2d7e71f998f2f70da9e78b14366c25a21cc45714bca832acb0888c21bbc33aabf8c52c0721d0578
SSDEEP 3072:G+io48UwXVLCUD6xNZcJizueaE7i8e8h9:FioZNk1aE7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8421290.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8421290.exe
Size 172KB
SHA256 b6756eac7497c8eaf1f8d0d8860e84ed6c4204a3c061367ea4304c641e2f68f0
MD5 30aa28ce8fe7e0306c6c23f43a8188be
SHA1 c5e75ac0d08b223833df143725f403b2f5ad518b
SHA512 d3b2f2bda8634daf0e1f98ece78e4aefc40ac2d644cdef9ee2d7e71f998f2f70da9e78b14366c25a21cc45714bca832acb0888c21bbc33aabf8c52c0721d0578
SSDEEP 3072:G+io48UwXVLCUD6xNZcJizueaE7i8e8h9:FioZNk1aE7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4764-160-0x000000000AF40000-0x000000000B558000-memory.dmp

Download

memory/4764-165-0x000000000ADD0000-0x000000000AE46000-memory.dmp

Download

memory/4764-172-0x0000000005490000-0x00000000054A0000-memory.dmp

Download

memory/4764-161-0x000000000AA30000-0x000000000AB3A000-memory.dmp

Download

memory/4764-162-0x000000000A960000-0x000000000A972000-memory.dmp

Download

memory/4764-163-0x000000000A9C0000-0x000000000A9FC000-memory.dmp

Download

memory/4764-164-0x0000000005490000-0x00000000054A0000-memory.dmp

Download

memory/4764-159-0x0000000000AA0000-0x0000000000AD0000-memory.dmp

Download

memory/4764-166-0x000000000B560000-0x000000000B5F2000-memory.dmp

Download

memory/4764-167-0x000000000AE50000-0x000000000AEB6000-memory.dmp

Download

memory/4764-168-0x000000000BEB0000-0x000000000C454000-memory.dmp

Download

memory/4764-169-0x000000000BAF0000-0x000000000BB40000-memory.dmp

Download

memory/4764-170-0x000000000C460000-0x000000000C622000-memory.dmp

Download

memory/4764-171-0x000000000CB60000-0x000000000D08C000-memory.dmp

Download

memory/4840-154-0x00000000000D0000-0x00000000000DA000-memory.dmp

Download