redline | edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c

General

Target

edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe
Size

581KB
MD5

d5e2746fc86a02663c69b2e6cb402d79
SHA1

d7a146dc64e73e74db2e4db708114d2df9ce501a
SHA256

edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c
SHA512

0dcf079e092da79e95ccd302aac85296aeb2df6570562d1a4aab955567bb0474373b3f374d9a3c0f1b949f52a45da8096c508bb167a4ee6d476897d3e8085a61
SSDEEP

12288:AMrzy90lt5TfPnggWJ+e6VayquifqnG71m5dhP7hzf26Xz:DyM9Xg3E4FMP7hzf7

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a8858106.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8858106.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8858106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8858106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8858106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8858106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8858106.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v8483042.exev0867038.exea8858106.exeb8978357.exe

pid process

5044 v8483042.exe
4952 v0867038.exe
4396 a8858106.exe
3660 b8978357.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a8858106.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8858106.exe

pid	process
5044	v8483042.exe
4952	v0867038.exe
4396	a8858106.exe
3660	b8978357.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8858106.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v8483042.exev0867038.exeedaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8483042.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8483042.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0867038.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0867038.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a8858106.exe

pid process

4396 a8858106.exe
4396 a8858106.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a8858106.exe

description pid process

Token: SeDebugPrivilege 4396 a8858106.exe

pid	process
4396	a8858106.exe
4396	a8858106.exe

description	pid	process
Token: SeDebugPrivilege	4396	a8858106.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exev8483042.exev0867038.exe

description	pid	process	target process
PID 2136 wrote to memory of 5044	2136	edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe	v8483042.exe
PID 2136 wrote to memory of 5044	2136	edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe	v8483042.exe
PID 2136 wrote to memory of 5044	2136	edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe	v8483042.exe
PID 5044 wrote to memory of 4952	5044	v8483042.exe	v0867038.exe
PID 5044 wrote to memory of 4952	5044	v8483042.exe	v0867038.exe
PID 5044 wrote to memory of 4952	5044	v8483042.exe	v0867038.exe
PID 4952 wrote to memory of 4396	4952	v0867038.exe	a8858106.exe
PID 4952 wrote to memory of 4396	4952	v0867038.exe	a8858106.exe
PID 4952 wrote to memory of 3660	4952	v0867038.exe	b8978357.exe
PID 4952 wrote to memory of 3660	4952	v0867038.exe	b8978357.exe
PID 4952 wrote to memory of 3660	4952	v0867038.exe	b8978357.exe

C:\Users\Admin\AppData\Local\Temp\edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe
"C:\Users\Admin\AppData\Local\Temp\edaa13dbdaf41327326d6b526a64de604cd8edcedb48f603f187183262fb696c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8483042.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8483042.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5044

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0867038.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0867038.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8858106.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8858106.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8978357.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8978357.exe
4⤵
- Executes dropped EXE
PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8483042.exe
Filesize
377KB

MD5
01b49654852493bc3c791dbdc513c822

SHA1
2500662c8466f0e37ebae611e4bbfc6ff9577b5e

SHA256
e4bae419759916153bc8c4ee4632c028c5fd3f3d191fd245c45408acc0d7c1ce

SHA512
a25cd3cf0925ce07246ac6e8f5ce9590ff72995424bf9a3b07d3e1d71a8502df6325bc50db9c2172ef204e7918a349995532c09edbf359ba3f088bb3c1e45f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8483042.exe
Filesize
377KB

MD5
01b49654852493bc3c791dbdc513c822

SHA1
2500662c8466f0e37ebae611e4bbfc6ff9577b5e

SHA256
e4bae419759916153bc8c4ee4632c028c5fd3f3d191fd245c45408acc0d7c1ce

SHA512
a25cd3cf0925ce07246ac6e8f5ce9590ff72995424bf9a3b07d3e1d71a8502df6325bc50db9c2172ef204e7918a349995532c09edbf359ba3f088bb3c1e45f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0867038.exe
Filesize
206KB

MD5
45fd534eddbfb668e7a53ce09bab54c2

SHA1
86c65421d8f568e6ce6be16a20d43e316dbd14ba

SHA256
9af2bae39249b04c2cbed18940b73e9268a9b390ee49489bfd6654c2042e8fbf

SHA512
bc935ca5f051bab4cb2c293948f79a5746fa45703e8eef8b3b79ff205cff283610ab6026b012eeedd4de70c9e39c4e1078b939d6d2669b40d253c44459c13735

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0867038.exe
Filesize
206KB

MD5
45fd534eddbfb668e7a53ce09bab54c2

SHA1
86c65421d8f568e6ce6be16a20d43e316dbd14ba

SHA256
9af2bae39249b04c2cbed18940b73e9268a9b390ee49489bfd6654c2042e8fbf

SHA512
bc935ca5f051bab4cb2c293948f79a5746fa45703e8eef8b3b79ff205cff283610ab6026b012eeedd4de70c9e39c4e1078b939d6d2669b40d253c44459c13735

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8858106.exe
Filesize
11KB

MD5
6b32fa9f5272a83ceb3f05207a463819

SHA1
798a35e9ea7d24e61351abffd312c37b7ee1045a

SHA256
41aedc3e975128a3476e2bd9140c729d88e14d2da0b08857be9172b6984884e6

SHA512
1312da29742211db5870fee66c49d9b8558bc808dc22fd4990b98d8b6e20045096c926db28bbfaceb95c31c5f80943760fd8ad80bedaafe0edefd4b0dfc54b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8858106.exe
Filesize
11KB

MD5
6b32fa9f5272a83ceb3f05207a463819

SHA1
798a35e9ea7d24e61351abffd312c37b7ee1045a

SHA256
41aedc3e975128a3476e2bd9140c729d88e14d2da0b08857be9172b6984884e6

SHA512
1312da29742211db5870fee66c49d9b8558bc808dc22fd4990b98d8b6e20045096c926db28bbfaceb95c31c5f80943760fd8ad80bedaafe0edefd4b0dfc54b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8978357.exe
Filesize
172KB

MD5
fa9365a590c1afde55151642d8e3b648

SHA1
b7a9fc6f246cd9365e049c50be7b90053d66b05e

SHA256
a23b24aa53018fdb7f432ff3a0e68206712c4bcd8464ea7f62019b58132afa17

SHA512
8cc8c24fdb7496ac96d752f0fab41fcb0454846bd2e1b33f26d575430dcf116c4f42649e321b8c6248a282dca81fa3534429a772310da32a60c0462460cba484

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8978357.exe
Filesize
172KB

MD5
fa9365a590c1afde55151642d8e3b648

SHA1
b7a9fc6f246cd9365e049c50be7b90053d66b05e

SHA256
a23b24aa53018fdb7f432ff3a0e68206712c4bcd8464ea7f62019b58132afa17

SHA512
8cc8c24fdb7496ac96d752f0fab41fcb0454846bd2e1b33f26d575430dcf116c4f42649e321b8c6248a282dca81fa3534429a772310da32a60c0462460cba484

Download Submit
memory/3660-159-0x0000000000F00000-0x0000000000F30000-memory.dmp

Filesize
192KB

Download
memory/3660-160-0x000000000B300000-0x000000000B918000-memory.dmp

Filesize
6.1MB

Download
memory/3660-161-0x000000000AE80000-0x000000000AF8A000-memory.dmp

Filesize
1.0MB

Download
memory/3660-162-0x000000000ADC0000-0x000000000ADD2000-memory.dmp

Filesize
72KB

Download
memory/3660-163-0x000000000AE20000-0x000000000AE5C000-memory.dmp

Filesize
240KB

Download
memory/3660-164-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/3660-165-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/4396-154-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads