redline | b95eef02765a18669b607d1a93775487bb3842510598fbd8cfbf7efd4ac666e5

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/06/2023, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 580KB
Sample230605-back3sed39
SHA256 b95eef02765a18669b607d1a93775487bb3842510598fbd8cfbf7efd4ac666e5
MD5 1adb7c887b38907f54b2608811f02494
SHA1 fd8894ff54d8f6884c515f46d39629fe006af734
SHA512 45c1c81c3b5c2551338662501c4c0811a41d9d2a4ae8ffb445d3625a9efb031b93f74f0f3ad01b0b4cff09f1163a416521072466249bb80e0541b7b5715f3d07
SSDEEP 12288:9Mr2y90y0b1NCx6eOyZkiDts1SfTtswV0yqWs:jy7caZkoLrtswV0z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9563891.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9563891.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k9563891.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9563891.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9563891.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9563891.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
280	y4714648.exe
1444	y7584198.exe
1448	k9563891.exe
824	l9120566.exe

Loads dropped DLL 7 IoCs

pid	Process
928	file.exe
280	y4714648.exe
280	y4714648.exe
1444	y7584198.exe
1444	y7584198.exe
1444	y7584198.exe
824	l9120566.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	k9563891.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9563891.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4714648.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4714648.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7584198.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7584198.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1448	k9563891.exe
1448	k9563891.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe
824	l9120566.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	k9563891.exe
Token: SeDebugPrivilege	824	l9120566.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 928 wrote to memory of 280	928	file.exe	27
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 280 wrote to memory of 1444	280	y4714648.exe	28
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 1448	1444	y7584198.exe	29
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30
PID 1444 wrote to memory of 824	1444	y7584198.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9563891.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9563891.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y4714648.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
Size 377KB
SHA256 7b1cc92fc17303ea8ed63c51851492bb256b8a00be094ae8c13cda726fbec839
MD5 c9b482c2dfb9798363341a6dc6f1ed13
SHA1 00d6e4814de4aade47e5bc877cbb11f58266fc9a
SHA512 e60d65a9b0dff7cbbce0803c428f4cf0458f5c63427e479a900419dcdd22769dcd439b3642682080d2667080bda8712ef75e07082145d422581144180c0995d3
SSDEEP 6144:Kwy+bnr+2p0yN90QEux/WG9T+K0YR8r9Gt+qpeYCOXNTupq:MMrGy90IYkyZYiYtmjSNTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4714648.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
Size 377KB
SHA256 7b1cc92fc17303ea8ed63c51851492bb256b8a00be094ae8c13cda726fbec839
MD5 c9b482c2dfb9798363341a6dc6f1ed13
SHA1 00d6e4814de4aade47e5bc877cbb11f58266fc9a
SHA512 e60d65a9b0dff7cbbce0803c428f4cf0458f5c63427e479a900419dcdd22769dcd439b3642682080d2667080bda8712ef75e07082145d422581144180c0995d3
SSDEEP 6144:Kwy+bnr+2p0yN90QEux/WG9T+K0YR8r9Gt+qpeYCOXNTupq:MMrGy90IYkyZYiYtmjSNTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7584198.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
Size 206KB
SHA256 362c7fea82131023366c5972ef39d01d9d12e778c9ac7e791ac0dd4449a24923
MD5 5ac8a26636a3caa579f914f4e9e9986d
SHA1 110ef053e60933bbe80aea83bed5ee0fffc50771
SHA512 a13f4b097ec00e6af27cedbacd423c93c9b7fa329ff4aa34a2d5662bda09c4dd28d1b55550463236af9c6d883bc462953933ce662bfc66e62afbbee109b7ebcb
SSDEEP 3072:K2y+bnr+O1l5GWp1icKAArDZz4N9GhbkrNEk1pnggu3/658V9JyKo596oC:K2y+bnr+Op0yN90QEr5V9o5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7584198.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
Size 206KB
SHA256 362c7fea82131023366c5972ef39d01d9d12e778c9ac7e791ac0dd4449a24923
MD5 5ac8a26636a3caa579f914f4e9e9986d
SHA1 110ef053e60933bbe80aea83bed5ee0fffc50771
SHA512 a13f4b097ec00e6af27cedbacd423c93c9b7fa329ff4aa34a2d5662bda09c4dd28d1b55550463236af9c6d883bc462953933ce662bfc66e62afbbee109b7ebcb
SSDEEP 3072:K2y+bnr+O1l5GWp1icKAArDZz4N9GhbkrNEk1pnggu3/658V9JyKo596oC:K2y+bnr+Op0yN90QEr5V9o5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

k9563891.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9563891.exe
Size 11KB
SHA256 cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829
MD5 9df47b120c7025ec8ffdc3338bf3371a
SHA1 18c9a5590d838f935ea38598118558686094db80
SHA512 a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k9563891.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9563891.exe
Size 11KB
SHA256 cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829
MD5 9df47b120c7025ec8ffdc3338bf3371a
SHA1 18c9a5590d838f935ea38598118558686094db80
SHA512 a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9120566.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
Size 172KB
SHA256 b875dab49a50c5a85a62bc5ec355b1cac3671f2a9f3222ca8b96d634f0ace6ac
MD5 063c378c59ac5a584e6ee782b6f99186
SHA1 78307405a9875a41e726374269800fa38bd81d21
SHA512 abf64157634775f437d71a77e020b62dac61707c1580fdd939b6ddedac561f1fabc5974d050396adc014f83f6f90880496a1af59dc8ccf410d6ab7afa26b2bb5
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9120566.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
Size 172KB
SHA256 b875dab49a50c5a85a62bc5ec355b1cac3671f2a9f3222ca8b96d634f0ace6ac
MD5 063c378c59ac5a584e6ee782b6f99186
SHA1 78307405a9875a41e726374269800fa38bd81d21
SHA512 abf64157634775f437d71a77e020b62dac61707c1580fdd939b6ddedac561f1fabc5974d050396adc014f83f6f90880496a1af59dc8ccf410d6ab7afa26b2bb5
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4714648.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
Size 377KB
SHA256 7b1cc92fc17303ea8ed63c51851492bb256b8a00be094ae8c13cda726fbec839
MD5 c9b482c2dfb9798363341a6dc6f1ed13
SHA1 00d6e4814de4aade47e5bc877cbb11f58266fc9a
SHA512 e60d65a9b0dff7cbbce0803c428f4cf0458f5c63427e479a900419dcdd22769dcd439b3642682080d2667080bda8712ef75e07082145d422581144180c0995d3
SSDEEP 6144:Kwy+bnr+2p0yN90QEux/WG9T+K0YR8r9Gt+qpeYCOXNTupq:MMrGy90IYkyZYiYtmjSNTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4714648.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\y4714648.exe
Size 377KB
SHA256 7b1cc92fc17303ea8ed63c51851492bb256b8a00be094ae8c13cda726fbec839
MD5 c9b482c2dfb9798363341a6dc6f1ed13
SHA1 00d6e4814de4aade47e5bc877cbb11f58266fc9a
SHA512 e60d65a9b0dff7cbbce0803c428f4cf0458f5c63427e479a900419dcdd22769dcd439b3642682080d2667080bda8712ef75e07082145d422581144180c0995d3
SSDEEP 6144:Kwy+bnr+2p0yN90QEux/WG9T+K0YR8r9Gt+qpeYCOXNTupq:MMrGy90IYkyZYiYtmjSNTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7584198.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
Size 206KB
SHA256 362c7fea82131023366c5972ef39d01d9d12e778c9ac7e791ac0dd4449a24923
MD5 5ac8a26636a3caa579f914f4e9e9986d
SHA1 110ef053e60933bbe80aea83bed5ee0fffc50771
SHA512 a13f4b097ec00e6af27cedbacd423c93c9b7fa329ff4aa34a2d5662bda09c4dd28d1b55550463236af9c6d883bc462953933ce662bfc66e62afbbee109b7ebcb
SSDEEP 3072:K2y+bnr+O1l5GWp1icKAArDZz4N9GhbkrNEk1pnggu3/658V9JyKo596oC:K2y+bnr+Op0yN90QEr5V9o5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7584198.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\y7584198.exe
Size 206KB
SHA256 362c7fea82131023366c5972ef39d01d9d12e778c9ac7e791ac0dd4449a24923
MD5 5ac8a26636a3caa579f914f4e9e9986d
SHA1 110ef053e60933bbe80aea83bed5ee0fffc50771
SHA512 a13f4b097ec00e6af27cedbacd423c93c9b7fa329ff4aa34a2d5662bda09c4dd28d1b55550463236af9c6d883bc462953933ce662bfc66e62afbbee109b7ebcb
SSDEEP 3072:K2y+bnr+O1l5GWp1icKAArDZz4N9GhbkrNEk1pnggu3/658V9JyKo596oC:K2y+bnr+Op0yN90QEr5V9o5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

k9563891.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\k9563891.exe
Size 11KB
SHA256 cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829
MD5 9df47b120c7025ec8ffdc3338bf3371a
SHA1 18c9a5590d838f935ea38598118558686094db80
SHA512 a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9120566.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
Size 172KB
SHA256 b875dab49a50c5a85a62bc5ec355b1cac3671f2a9f3222ca8b96d634f0ace6ac
MD5 063c378c59ac5a584e6ee782b6f99186
SHA1 78307405a9875a41e726374269800fa38bd81d21
SHA512 abf64157634775f437d71a77e020b62dac61707c1580fdd939b6ddedac561f1fabc5974d050396adc014f83f6f90880496a1af59dc8ccf410d6ab7afa26b2bb5
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9120566.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\l9120566.exe
Size 172KB
SHA256 b875dab49a50c5a85a62bc5ec355b1cac3671f2a9f3222ca8b96d634f0ace6ac
MD5 063c378c59ac5a584e6ee782b6f99186
SHA1 78307405a9875a41e726374269800fa38bd81d21
SHA512 abf64157634775f437d71a77e020b62dac61707c1580fdd939b6ddedac561f1fabc5974d050396adc014f83f6f90880496a1af59dc8ccf410d6ab7afa26b2bb5
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/824-89-0x0000000000E80000-0x0000000000EB0000-memory.dmp

Download

memory/824-90-0x0000000000390000-0x0000000000396000-memory.dmp

Download

memory/824-91-0x0000000004A10000-0x0000000004A50000-memory.dmp

Download

memory/824-92-0x0000000004A10000-0x0000000004A50000-memory.dmp

Download

memory/1448-82-0x0000000000840000-0x000000000084A000-memory.dmp

Download