redline | 8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64

General

Target

8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe
Size

581KB
MD5

616f8396421dfafab335cc19078a7340
SHA1

06e8cd46b3c14d456641a3004cdb2e12afa4ee15
SHA256

8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64
SHA512

d83e34d5be669506ccb58cbf934b672ebe93b9f798dfa47ccbee015be1e19ff97b53c47e431434b94c621ca7b46f1ffabef7325b3332156dc823ebf5de15398c
SSDEEP

12288:EMr4y90pbl1iD1elR0BBkg8qmaLDwEEoBl0OnpWcE:cyk/61rk5a3JnMcE

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4317883.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4317883.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4317883.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4317883.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k4317883.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4317883.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
3724	y0983438.exe
376	y2377408.exe
4880	k4317883.exe
1440	l3926051.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4317883.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0983438.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0983438.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2377408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y2377408.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	k4317883.exe
4880	k4317883.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	k4317883.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3724	432	8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe	82
PID 432 wrote to memory of 3724	432	8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe	82
PID 432 wrote to memory of 3724	432	8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe	82
PID 3724 wrote to memory of 376	3724	y0983438.exe	83
PID 3724 wrote to memory of 376	3724	y0983438.exe	83
PID 3724 wrote to memory of 376	3724	y0983438.exe	83
PID 376 wrote to memory of 4880	376	y2377408.exe	84
PID 376 wrote to memory of 4880	376	y2377408.exe	84
PID 376 wrote to memory of 1440	376	y2377408.exe	89
PID 376 wrote to memory of 1440	376	y2377408.exe	89
PID 376 wrote to memory of 1440	376	y2377408.exe	89

C:\Users\Admin\AppData\Local\Temp\8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe
"C:\Users\Admin\AppData\Local\Temp\8a45be8b14d58741586b07c2899a3d1789ac9b2fea7a3bbddbb103048d123e64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0983438.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0983438.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2377408.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2377408.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4317883.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4317883.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3926051.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3926051.exe
      4⤵
      Executes dropped EXE
      PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0983438.exe

Filesize
377KB

MD5
31092782e6635246537f663da5c3b38d

SHA1
b5f9005deb19a72ab5232868ec3d85558b0afbfb

SHA256
497e70854ffbc6986cd17b383400ad9380c2a9b0727135708fd120b609508ba7

SHA512
a37688cf8fb5f15306bca32c27eb4f6e74ed4f1a8a4340c25a3a8c7864c6e040e1a9b91993517725efcd4edf95506249b7e5cf7c71a06e04d1edb9a2b26d387f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0983438.exe

Filesize
377KB

MD5
31092782e6635246537f663da5c3b38d

SHA1
b5f9005deb19a72ab5232868ec3d85558b0afbfb

SHA256
497e70854ffbc6986cd17b383400ad9380c2a9b0727135708fd120b609508ba7

SHA512
a37688cf8fb5f15306bca32c27eb4f6e74ed4f1a8a4340c25a3a8c7864c6e040e1a9b91993517725efcd4edf95506249b7e5cf7c71a06e04d1edb9a2b26d387f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2377408.exe

Filesize
206KB

MD5
5eea485f5d8ea26b5be6bca783bfadef

SHA1
3c6819e57a5c4185203f0a02ad11826b001a739f

SHA256
bbb0ae4409e77a31d7946909395e23ac158102de2818b870d579621ac8d5a258

SHA512
5e1f21ecdf916b7014578a2dfdc0ea0339015fb3f8ac593a94a174eaa1f376f2f652e0b5c91e114e3f34b05959aa5f4eb459511f2374eb7c46988ee90bcad9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2377408.exe

Filesize
206KB

MD5
5eea485f5d8ea26b5be6bca783bfadef

SHA1
3c6819e57a5c4185203f0a02ad11826b001a739f

SHA256
bbb0ae4409e77a31d7946909395e23ac158102de2818b870d579621ac8d5a258

SHA512
5e1f21ecdf916b7014578a2dfdc0ea0339015fb3f8ac593a94a174eaa1f376f2f652e0b5c91e114e3f34b05959aa5f4eb459511f2374eb7c46988ee90bcad9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4317883.exe

Filesize
11KB

MD5
1860629c853db835d26206efc9f0becb

SHA1
201177a81056e271a3ba5c5017b87343f5886265

SHA256
2c6055c06fc2c5a3f6cf247b3a5aa492cb3f61d4666f555a3c2a13dc0113c884

SHA512
33f4a86c2d3ec6918b55606a158fc80c658487cf74383945ad4e75fedcf050bf72048e6419b98ba14eff11fdcd7e8ab02e2fe28b53038ca4efc3a32cabcf4a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4317883.exe

Filesize
11KB

MD5
1860629c853db835d26206efc9f0becb

SHA1
201177a81056e271a3ba5c5017b87343f5886265

SHA256
2c6055c06fc2c5a3f6cf247b3a5aa492cb3f61d4666f555a3c2a13dc0113c884

SHA512
33f4a86c2d3ec6918b55606a158fc80c658487cf74383945ad4e75fedcf050bf72048e6419b98ba14eff11fdcd7e8ab02e2fe28b53038ca4efc3a32cabcf4a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3926051.exe

Filesize
172KB

MD5
a39cbee54840995521fd25e600f27e6d

SHA1
0ea057906955aa95c4486a4c82d41408e6058918

SHA256
9677e76c3a731b57fae3a6b437928e5fddfa4c658c1fd5a1ef40485e457d1ec1

SHA512
8573b4696b186a1ed8d5348e4d30fba5d5be199874565291df50873e864610415c378f309b8aa4bcd3a8894e3f90b77ee234a03214065c91f811c4e520117dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3926051.exe

Filesize
172KB

MD5
a39cbee54840995521fd25e600f27e6d

SHA1
0ea057906955aa95c4486a4c82d41408e6058918

SHA256
9677e76c3a731b57fae3a6b437928e5fddfa4c658c1fd5a1ef40485e457d1ec1

SHA512
8573b4696b186a1ed8d5348e4d30fba5d5be199874565291df50873e864610415c378f309b8aa4bcd3a8894e3f90b77ee234a03214065c91f811c4e520117dc1

Download Submit
memory/1440-159-0x0000000000D00000-0x0000000000D30000-memory.dmp

Filesize
192KB

Download
memory/1440-160-0x000000000B100000-0x000000000B718000-memory.dmp

Filesize
6.1MB

Download
memory/1440-161-0x000000000AC80000-0x000000000AD8A000-memory.dmp

Filesize
1.0MB

Download
memory/1440-162-0x000000000ABC0000-0x000000000ABD2000-memory.dmp

Filesize
72KB

Download
memory/1440-163-0x000000000AC20000-0x000000000AC5C000-memory.dmp

Filesize
240KB

Download
memory/1440-164-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/1440-165-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/4880-154-0x00000000007C0000-0x00000000007CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads