redline | f7cbb0bc47edee3ed1f8c2ee39171e1e71d9e55b6e86df5ff9010f6d7e8975e1

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 580KB
Sample230605-ajw6eaeg7w
SHA256 f7cbb0bc47edee3ed1f8c2ee39171e1e71d9e55b6e86df5ff9010f6d7e8975e1
MD5 7dcd7d518ad5cc74b98f26e93ad0433f
SHA1 404a8f6e4811b8b8ea86e917406e5babf3e44ff3
SHA512 6ce5a894ba5a5e7742d1908d53c3601bd96aee2541aa96681d36d3a77b68ca558601ac7ef64f9bb7c9f883cc1eb99f9a9b6c04b4d633f9704d88445b4d4a6162
SSDEEP 12288:yMrIy90m+v902c84CEksFgE25AUSz9MMdgipq6lpFSM:Gy0l0n8Ut/256XvlpFSM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k4209749.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4209749.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4209749.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4209749.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4209749.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4209749.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
460	y7519187.exe
2296	y4605933.exe
4240	k4209749.exe
2896	l5482728.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4209749.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7519187.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7519187.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4605933.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4605933.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	k4209749.exe
4240	k4209749.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	k4209749.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 460	3812	file.exe	84
PID 3812 wrote to memory of 460	3812	file.exe	84
PID 3812 wrote to memory of 460	3812	file.exe	84
PID 460 wrote to memory of 2296	460	y7519187.exe	85
PID 460 wrote to memory of 2296	460	y7519187.exe	85
PID 460 wrote to memory of 2296	460	y7519187.exe	85
PID 2296 wrote to memory of 4240	2296	y4605933.exe	86
PID 2296 wrote to memory of 4240	2296	y4605933.exe	86
PID 2296 wrote to memory of 2896	2296	y4605933.exe	91
PID 2296 wrote to memory of 2896	2296	y4605933.exe	91
PID 2296 wrote to memory of 2896	2296	y4605933.exe	91

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7519187.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7519187.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4605933.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4605933.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4209749.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4209749.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5482728.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5482728.exe
      4⤵
      Executes dropped EXE
      PID:2896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y7519187.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7519187.exe
Size 377KB
SHA256 c209ef34012a91d7a111dfff2c2879cf3171ff6e9bdba866a771c0bfe7cb4753
MD5 457aff90cc28fed417e36631de88e7fe
SHA1 cd8bb00a9b194943492010c0a91a46b0f448202a
SHA512 b0504974664325e7fb7653f837fbd1bfc073b40c9e6ebe44c75f8d73c36a04458a163b753d4a07547e30dde7a03785dd5e75ed6eaa9f441b9c267ab2fb6a1aff
SSDEEP 6144:Kjy+bnr+qp0yN90QEWZ8EHtspqz9gH5RGfp7AUEcZS8XToVdc504:pMrCy90oCENs0gZO7AUEcbTMdz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7519187.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7519187.exe
Size 377KB
SHA256 c209ef34012a91d7a111dfff2c2879cf3171ff6e9bdba866a771c0bfe7cb4753
MD5 457aff90cc28fed417e36631de88e7fe
SHA1 cd8bb00a9b194943492010c0a91a46b0f448202a
SHA512 b0504974664325e7fb7653f837fbd1bfc073b40c9e6ebe44c75f8d73c36a04458a163b753d4a07547e30dde7a03785dd5e75ed6eaa9f441b9c267ab2fb6a1aff
SSDEEP 6144:Kjy+bnr+qp0yN90QEWZ8EHtspqz9gH5RGfp7AUEcZS8XToVdc504:pMrCy90oCENs0gZO7AUEcbTMdz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4605933.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4605933.exe
Size 206KB
SHA256 3f9dd9a4e329d28a4ba505cfada9d2efac54f7a60d7d762ab7e4cdf81795df4f
MD5 8bd38ea7a3d4443ba45df3aab3aafba2
SHA1 73d99cacac430749766b9c5b023448eea8a98f47
SHA512 a28f5949f28d7541f3241dab3d0d0342986ac52b97050c9b3126c9444bbfc1eacee81fd3ec7a654807422a38e38f2ff731718c6d7879eb20b4d1e3e231f83dac
SSDEEP 3072:Key+bnr+O1J5GWp1icKAArDZz4N9GhbkrNEk1Zbvi7V2sJ462nxhlDX3Sg5oc:Key+bnr+yp0yN90QEKK7V2sMV7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4605933.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4605933.exe
Size 206KB
SHA256 3f9dd9a4e329d28a4ba505cfada9d2efac54f7a60d7d762ab7e4cdf81795df4f
MD5 8bd38ea7a3d4443ba45df3aab3aafba2
SHA1 73d99cacac430749766b9c5b023448eea8a98f47
SHA512 a28f5949f28d7541f3241dab3d0d0342986ac52b97050c9b3126c9444bbfc1eacee81fd3ec7a654807422a38e38f2ff731718c6d7879eb20b4d1e3e231f83dac
SSDEEP 3072:Key+bnr+O1J5GWp1icKAArDZz4N9GhbkrNEk1Zbvi7V2sJ462nxhlDX3Sg5oc:Key+bnr+yp0yN90QEKK7V2sMV7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

k4209749.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4209749.exe
Size 11KB
SHA256 015f7b41c79d9f6ab7e5670f55defaaba2a4e8ba56992538856e00e611850b8d
MD5 a4d34446cfdf12793374ccb7ba0da56f
SHA1 197dedbeab753c93fb0efd1bf52d7516ec465f06
SHA512 bfa6d6a60933a90d2603b0e76c5809644c353b09ae6f72f69d5c3780f2c110237ed72b8bb77f2ca606b1c6c0b6db66e15ff54836a60f13140f597bcb78f03fe6
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k4209749.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4209749.exe
Size 11KB
SHA256 015f7b41c79d9f6ab7e5670f55defaaba2a4e8ba56992538856e00e611850b8d
MD5 a4d34446cfdf12793374ccb7ba0da56f
SHA1 197dedbeab753c93fb0efd1bf52d7516ec465f06
SHA512 bfa6d6a60933a90d2603b0e76c5809644c353b09ae6f72f69d5c3780f2c110237ed72b8bb77f2ca606b1c6c0b6db66e15ff54836a60f13140f597bcb78f03fe6
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5482728.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5482728.exe
Size 172KB
SHA256 5f8c44abd1b869b262fe5077e2628362be95b1239fbfb6560a55368a4ceb8ae0
MD5 7e9112693ddf6f4d31590f78745f4bc6
SHA1 ce56493a5fb84bf50808090337a95ad73ac28eff
SHA512 a60fa725debc3e9ad35b5aa7a09e9c8ecd30078af13f02a89f81cd998f24bdccead1251afa620cfbdb11612d75f5cf64d20a2acc4f0578a9c4fd4ef1fe9672d7
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5482728.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5482728.exe
Size 172KB
SHA256 5f8c44abd1b869b262fe5077e2628362be95b1239fbfb6560a55368a4ceb8ae0
MD5 7e9112693ddf6f4d31590f78745f4bc6
SHA1 ce56493a5fb84bf50808090337a95ad73ac28eff
SHA512 a60fa725debc3e9ad35b5aa7a09e9c8ecd30078af13f02a89f81cd998f24bdccead1251afa620cfbdb11612d75f5cf64d20a2acc4f0578a9c4fd4ef1fe9672d7
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2896-159-0x0000000000CC0000-0x0000000000CF0000-memory.dmp

Download

memory/2896-160-0x000000000B1A0000-0x000000000B7B8000-memory.dmp

Download

memory/2896-161-0x000000000AC90000-0x000000000AD9A000-memory.dmp

Download

memory/2896-162-0x000000000AB80000-0x000000000AB92000-memory.dmp

Download

memory/2896-163-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/2896-164-0x000000000ABE0000-0x000000000AC1C000-memory.dmp

Download

memory/2896-165-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/4240-154-0x0000000000430000-0x000000000043A000-memory.dmp

Download