redline | 43437585c100c2fc9997a0b900ff974c87ecb34de67e52caebce716903ab9dca

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 580KB
Sample230605-al64dsec63
SHA256 43437585c100c2fc9997a0b900ff974c87ecb34de67e52caebce716903ab9dca
MD5 c49a3d95bb31169caabc98afd195a763
SHA1 35c4496b38903a38c1036ce32304b82485a96d6c
SHA512 3632405ffe60cd8dad8290afa4ca895bdf0d22bbe8b76abe0ad4715504562b188664d4d3746dcd0bc49ebbd60b4bb3a01a8f90c867c76a3bba2ac850ad995583
SSDEEP 12288:rMrGy90r9ZrTHPy2Wiqcskyk4wbLDsvavh0uFhVw4:JyqrvW0skymTsvaveihn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1863582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1863582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1863582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1863582.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k1863582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1863582.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1432	y4620605.exe
4624	y8472552.exe
1464	k1863582.exe
2724	l1378628.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1863582.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8472552.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4620605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4620605.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8472552.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1464	k1863582.exe
1464	k1863582.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe
2724	l1378628.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	k1863582.exe
Token: SeDebugPrivilege	2724	l1378628.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1432	1160	file.exe	82
PID 1160 wrote to memory of 1432	1160	file.exe	82
PID 1160 wrote to memory of 1432	1160	file.exe	82
PID 1432 wrote to memory of 4624	1432	y4620605.exe	83
PID 1432 wrote to memory of 4624	1432	y4620605.exe	83
PID 1432 wrote to memory of 4624	1432	y4620605.exe	83
PID 4624 wrote to memory of 1464	4624	y8472552.exe	84
PID 4624 wrote to memory of 1464	4624	y8472552.exe	84
PID 4624 wrote to memory of 2724	4624	y8472552.exe	85
PID 4624 wrote to memory of 2724	4624	y8472552.exe	85
PID 4624 wrote to memory of 2724	4624	y8472552.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4620605.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4620605.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8472552.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8472552.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1863582.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1863582.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1378628.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1378628.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y4620605.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4620605.exe
Size 377KB
SHA256 6308c431bda101f059c39239e2d174ee64a196d7d85f1014cb164553c00cc894
MD5 e9cab881ba8c985e20e545b455d38002
SHA1 e59fa7f879c7b00e60578aa81d6117d779963283
SHA512 aa3fca5f77e400cee0f76a6258ed3bced3869544133287341c63145c6f1e3e0d195de0e11364ab65d5b6a8edf0278e2861e2506ebebfc88430150b54a178b40e
SSDEEP 6144:K1y+bnr+Sp0yN90QEfCCSMrJt4MVskDARrGwLXIcNO/IF/KSbvQ:bMrqy90swqasTyg4wj/KUvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4620605.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4620605.exe
Size 377KB
SHA256 6308c431bda101f059c39239e2d174ee64a196d7d85f1014cb164553c00cc894
MD5 e9cab881ba8c985e20e545b455d38002
SHA1 e59fa7f879c7b00e60578aa81d6117d779963283
SHA512 aa3fca5f77e400cee0f76a6258ed3bced3869544133287341c63145c6f1e3e0d195de0e11364ab65d5b6a8edf0278e2861e2506ebebfc88430150b54a178b40e
SSDEEP 6144:K1y+bnr+Sp0yN90QEfCCSMrJt4MVskDARrGwLXIcNO/IF/KSbvQ:bMrqy90swqasTyg4wj/KUvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

y8472552.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8472552.exe
Size 206KB
SHA256 5b7b5a323bd75430220606336441e39c41004acc9b2599f4fd4e2ac7a656e939
MD5 42fa5fe25a1ad0fc2c98198d41461fdf
SHA1 865102982e5e8704f3ef83af71fda89203d79e86
SHA512 07022bb95b1a8512399e73df96d46ee02a3b75f557d58085f550fea23753836edade6030b7ef6416c3e293298fd1a6a4fbcef21940a9ace709df45b073aca2e9
SSDEEP 3072:KWy+bnr+O1W5GWp1icKAArDZz4N9GhbkrNEk1fJAsB6XWWdVf1oQzF+Cpn62EiFm:KWy+bnr+Rp0yN90QEqPbJQf62EQLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

y8472552.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8472552.exe
Size 206KB
SHA256 5b7b5a323bd75430220606336441e39c41004acc9b2599f4fd4e2ac7a656e939
MD5 42fa5fe25a1ad0fc2c98198d41461fdf
SHA1 865102982e5e8704f3ef83af71fda89203d79e86
SHA512 07022bb95b1a8512399e73df96d46ee02a3b75f557d58085f550fea23753836edade6030b7ef6416c3e293298fd1a6a4fbcef21940a9ace709df45b073aca2e9
SSDEEP 3072:KWy+bnr+O1W5GWp1icKAArDZz4N9GhbkrNEk1fJAsB6XWWdVf1oQzF+Cpn62EiFm:KWy+bnr+Rp0yN90QEqPbJQf62EQLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1863582.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1863582.exe
Size 11KB
SHA256 ce366b75ad5ae005efe2a1aecb50bf14d7bf76d7bf9dbaeeafd9e01a7126aa7e
MD5 fcf44d8e247adc2837b101952ff1adf8
SHA1 9267d75fdafafdc484f32827e1a348a847c262d5
SHA512 61fdf63a107558b2e0aaeca841bdd1b7eb046cebd69c728885ab32b62dcb493073ae099932144c7abb2269b942f86786db8c32d58ab890a5e76da014ec70ea17
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1863582.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1863582.exe
Size 11KB
SHA256 ce366b75ad5ae005efe2a1aecb50bf14d7bf76d7bf9dbaeeafd9e01a7126aa7e
MD5 fcf44d8e247adc2837b101952ff1adf8
SHA1 9267d75fdafafdc484f32827e1a348a847c262d5
SHA512 61fdf63a107558b2e0aaeca841bdd1b7eb046cebd69c728885ab32b62dcb493073ae099932144c7abb2269b942f86786db8c32d58ab890a5e76da014ec70ea17
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1378628.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1378628.exe
Size 172KB
SHA256 7abbc54f4227e9a6d50121fa6951826f31897cdb6364bd517e18382210724906
MD5 44060c06b21383acf25b558fb2748bc7
SHA1 9eb19b1d8cbf164125e7ae3ff848f76d3879154a
SHA512 df1cf3c3035b5efca9f09a2509001be5ec6d1a7b67979b78b40a7e25333a77a9d769a3cacf8ee73c52469010c57069c82689d6c76d83bb77dd3b7e4ed1f4a982
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1378628.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1378628.exe
Size 172KB
SHA256 7abbc54f4227e9a6d50121fa6951826f31897cdb6364bd517e18382210724906
MD5 44060c06b21383acf25b558fb2748bc7
SHA1 9eb19b1d8cbf164125e7ae3ff848f76d3879154a
SHA512 df1cf3c3035b5efca9f09a2509001be5ec6d1a7b67979b78b40a7e25333a77a9d769a3cacf8ee73c52469010c57069c82689d6c76d83bb77dd3b7e4ed1f4a982
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1464-154-0x0000000000E70000-0x0000000000E7A000-memory.dmp

Download

memory/2724-160-0x000000000AEC0000-0x000000000B4D8000-memory.dmp

Download

memory/2724-166-0x000000000AE10000-0x000000000AEA2000-memory.dmp

Download

memory/2724-161-0x000000000AA40000-0x000000000AB4A000-memory.dmp

Download

memory/2724-162-0x000000000A980000-0x000000000A992000-memory.dmp

Download

memory/2724-163-0x000000000A9E0000-0x000000000AA1C000-memory.dmp

Download

memory/2724-164-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/2724-165-0x000000000ACF0000-0x000000000AD66000-memory.dmp

Download

memory/2724-159-0x0000000000AC0000-0x0000000000AF0000-memory.dmp

Download

memory/2724-167-0x000000000BA90000-0x000000000C034000-memory.dmp

Download

memory/2724-168-0x000000000B5E0000-0x000000000B646000-memory.dmp

Download

memory/2724-169-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/2724-170-0x000000000BA10000-0x000000000BA60000-memory.dmp

Download

memory/2724-171-0x000000000C310000-0x000000000C4D2000-memory.dmp

Download

memory/2724-172-0x000000000CA10000-0x000000000CF3C000-memory.dmp

Download