redline | 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae

General

Target

844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
Size

580KB
MD5

f0847f9859792ea3f7138a6d8b958ea5
SHA1

fc8d49204c7be0a62b62700513e3596a6074852c
SHA256

844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae
SHA512

8e0e06712a628ef4289d998c72819c636338baab0ecf482f3510f4f3e35888ef1c56dfd6914f35829d1c2e12ac73b5f94534da9ecc839929e0321adcee232fd0
SSDEEP

12288:qMrcy907AAs7hmNR0jyg+PZhQzEgFFrNbcDAPJGI64F:SymAAYUWjOZhEEgFF1cUA4F

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2928851.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k2928851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2928851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2928851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2928851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2928851.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2672	y8075178.exe
2516	y4564900.exe
2064	k2928851.exe
1548	l3235075.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2928851.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8075178.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4564900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4564900.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8075178.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	k2928851.exe
2064	k2928851.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	k2928851.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2672	2648	844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe	82
PID 2648 wrote to memory of 2672	2648	844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe	82
PID 2648 wrote to memory of 2672	2648	844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe	82
PID 2672 wrote to memory of 2516	2672	y8075178.exe	83
PID 2672 wrote to memory of 2516	2672	y8075178.exe	83
PID 2672 wrote to memory of 2516	2672	y8075178.exe	83
PID 2516 wrote to memory of 2064	2516	y4564900.exe	84
PID 2516 wrote to memory of 2064	2516	y4564900.exe	84
PID 2516 wrote to memory of 1548	2516	y4564900.exe	85
PID 2516 wrote to memory of 1548	2516	y4564900.exe	85
PID 2516 wrote to memory of 1548	2516	y4564900.exe	85

C:\Users\Admin\AppData\Local\Temp\844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
"C:\Users\Admin\AppData\Local\Temp\844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exe
      4⤵
      Executes dropped EXE
      PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exe

Filesize
377KB

MD5
ebf0eb697e2eb9a2fd48acd1df407477

SHA1
b320bc35321f1845cd617dfddcb6a3ecb50d8f69

SHA256
3006f4c7b146e01c9a9818fc7c64cfeed526d279b7cc68684c1cd1b72a717fce

SHA512
72b53c6b33b99bf9821a8adafac3b535f18024cf25a458b9a745c7a6b46ad862c74227174f8fd700e99079edd03b46828ee186ca535ce7eb6580cffa1e244b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exe

Filesize
377KB

MD5
ebf0eb697e2eb9a2fd48acd1df407477

SHA1
b320bc35321f1845cd617dfddcb6a3ecb50d8f69

SHA256
3006f4c7b146e01c9a9818fc7c64cfeed526d279b7cc68684c1cd1b72a717fce

SHA512
72b53c6b33b99bf9821a8adafac3b535f18024cf25a458b9a745c7a6b46ad862c74227174f8fd700e99079edd03b46828ee186ca535ce7eb6580cffa1e244b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exe

Filesize
206KB

MD5
b7fe6928880d76f33b0bab88fbe140ca

SHA1
c164d64f078ee915e6a9af2982a519fa48533247

SHA256
a33284f985b4e1177be56bdc71e1102fd09735a019028eff3def79b713962fcc

SHA512
9f405293e496ce0b3de60bdef216f20e924fb9835a664ff3707457a620370b7527415fe1a7bd2b92031cb256cc3d3fe219880898be3665a922a06c39616c0eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exe

Filesize
206KB

MD5
b7fe6928880d76f33b0bab88fbe140ca

SHA1
c164d64f078ee915e6a9af2982a519fa48533247

SHA256
a33284f985b4e1177be56bdc71e1102fd09735a019028eff3def79b713962fcc

SHA512
9f405293e496ce0b3de60bdef216f20e924fb9835a664ff3707457a620370b7527415fe1a7bd2b92031cb256cc3d3fe219880898be3665a922a06c39616c0eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exe

Filesize
11KB

MD5
3b416a1b882466bd99311dbab98fb42d

SHA1
286eaf9931732e12f2ba571d44e4bb20e20d0022

SHA256
9810f5b05ccbee3d0d4dc6368bbafdb3fd80eb506f5f443969dd98747febe29d

SHA512
5903569d34bced97c27426313c309f243d5eb145bf496eccd2ee598a61154da0057b4753a6a1de1fa9a8f76bb51b6a7c53937d91456abda15cce93ac9554baad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exe

Filesize
11KB

MD5
3b416a1b882466bd99311dbab98fb42d

SHA1
286eaf9931732e12f2ba571d44e4bb20e20d0022

SHA256
9810f5b05ccbee3d0d4dc6368bbafdb3fd80eb506f5f443969dd98747febe29d

SHA512
5903569d34bced97c27426313c309f243d5eb145bf496eccd2ee598a61154da0057b4753a6a1de1fa9a8f76bb51b6a7c53937d91456abda15cce93ac9554baad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exe

Filesize
172KB

MD5
19f2f5c9fbc01659e46de13a208ec5f2

SHA1
dbdfc856bea346c0f98800d79b85ad3b956d9461

SHA256
f7c3a4db658ca825b3b70722154f7701c6debb37c097ff818401add7675b2cc1

SHA512
5bba834d41a28ed4dcc0bcaeae2e85f547d326616d4636aeede64ab733e301fd5510d2edf6ca08b0f50b9d63b3de2fb1c6316b63fe193c807997bb64925e4d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exe

Filesize
172KB

MD5
19f2f5c9fbc01659e46de13a208ec5f2

SHA1
dbdfc856bea346c0f98800d79b85ad3b956d9461

SHA256
f7c3a4db658ca825b3b70722154f7701c6debb37c097ff818401add7675b2cc1

SHA512
5bba834d41a28ed4dcc0bcaeae2e85f547d326616d4636aeede64ab733e301fd5510d2edf6ca08b0f50b9d63b3de2fb1c6316b63fe193c807997bb64925e4d11

Download Submit
memory/1548-159-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/1548-160-0x000000000A6A0000-0x000000000ACB8000-memory.dmp

Filesize
6.1MB

Download
memory/1548-161-0x000000000A190000-0x000000000A29A000-memory.dmp

Filesize
1.0MB

Download
memory/1548-162-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/1548-163-0x000000000A0A0000-0x000000000A0B2000-memory.dmp

Filesize
72KB

Download
memory/1548-164-0x000000000A100000-0x000000000A13C000-memory.dmp

Filesize
240KB

Download
memory/1548-165-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/2064-154-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads