redline | 65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b

General

Target

65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe
Size

581KB
MD5

c1e47cbba1766521eb46cfadac0f2f43
SHA1

69c59918818d333408890b3bffc8f42aa45afbba
SHA256

65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b
SHA512

93cb870609b31e8b5d82f28c878224f745360982c82a2823e8164536f4c6ea189fddffefcab72318fb18e24346d29fa8c00397c1f18f67a63a17a27276fc1de7
SSDEEP

12288:xMrzy90ajANF2uMdTeK78XW72CN9oMlVNzLgj2lBNih:Kyv+0FXHj/ZgCM

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a1797546.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1797546.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1797546.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1797546.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1797546.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1797546.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1797546.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v5261214.exev7849614.exea1797546.exeb9041074.exe

pid process

800 v5261214.exe
4484 v7849614.exe
1444 a1797546.exe
2828 b9041074.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a1797546.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1797546.exe

pid	process
800	v5261214.exe
4484	v7849614.exe
1444	a1797546.exe
2828	b9041074.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1797546.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v5261214.exev7849614.exe65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5261214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5261214.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7849614.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7849614.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1797546.exe

pid process

1444 a1797546.exe
1444 a1797546.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1797546.exe

description pid process

Token: SeDebugPrivilege 1444 a1797546.exe

pid	process
1444	a1797546.exe
1444	a1797546.exe

description	pid	process
Token: SeDebugPrivilege	1444	a1797546.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exev5261214.exev7849614.exe

description	pid	process	target process
PID 4628 wrote to memory of 800	4628	65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe	v5261214.exe
PID 4628 wrote to memory of 800	4628	65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe	v5261214.exe
PID 4628 wrote to memory of 800	4628	65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe	v5261214.exe
PID 800 wrote to memory of 4484	800	v5261214.exe	v7849614.exe
PID 800 wrote to memory of 4484	800	v5261214.exe	v7849614.exe
PID 800 wrote to memory of 4484	800	v5261214.exe	v7849614.exe
PID 4484 wrote to memory of 1444	4484	v7849614.exe	a1797546.exe
PID 4484 wrote to memory of 1444	4484	v7849614.exe	a1797546.exe
PID 4484 wrote to memory of 2828	4484	v7849614.exe	b9041074.exe
PID 4484 wrote to memory of 2828	4484	v7849614.exe	b9041074.exe
PID 4484 wrote to memory of 2828	4484	v7849614.exe	b9041074.exe

C:\Users\Admin\AppData\Local\Temp\65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe
"C:\Users\Admin\AppData\Local\Temp\65ba8ecad6bfd7e358ab6ea6890cf929c6e5d9656da2548006bc79a9a374f00b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4484

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exe
4⤵
- Executes dropped EXE
PID:2828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exe
Filesize
378KB

MD5
8ddbe30c65e48f5350e1126f1a907cc2

SHA1
22f2c61e9b8fd4b37ab7f6b4a503f2fe1d0a8b69

SHA256
0276ddd2bd672bd13f1ced74d4c74ca95767a2f7c1d9c5ef13d4ce3f3586dcdc

SHA512
470ccb3d5988f28dedf7159c0896709ba641780b86f80c58264f5c7ca6d51558f2f748897ea0ed3c1595cadf46e05e1ce1212edc256af7c58d8c53c04d83c41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5261214.exe
Filesize
378KB

MD5
8ddbe30c65e48f5350e1126f1a907cc2

SHA1
22f2c61e9b8fd4b37ab7f6b4a503f2fe1d0a8b69

SHA256
0276ddd2bd672bd13f1ced74d4c74ca95767a2f7c1d9c5ef13d4ce3f3586dcdc

SHA512
470ccb3d5988f28dedf7159c0896709ba641780b86f80c58264f5c7ca6d51558f2f748897ea0ed3c1595cadf46e05e1ce1212edc256af7c58d8c53c04d83c41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exe
Filesize
206KB

MD5
9e71223d00454584a9c7e51a6758cfe5

SHA1
403351a8afc244116f387b6b6404deb100c95ea1

SHA256
90cd2291c5c08d2cf9e2f848e6a6affcb32eadab29c93a28816652858fd56d22

SHA512
8e006a7779dcee7e205278da7c3c0d830f267e055328adbc02db04182dcaaee5f6b16add4f67257b49c819cf9d3ecb88c5faad190a99291fb46835fb313a8e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7849614.exe
Filesize
206KB

MD5
9e71223d00454584a9c7e51a6758cfe5

SHA1
403351a8afc244116f387b6b6404deb100c95ea1

SHA256
90cd2291c5c08d2cf9e2f848e6a6affcb32eadab29c93a28816652858fd56d22

SHA512
8e006a7779dcee7e205278da7c3c0d830f267e055328adbc02db04182dcaaee5f6b16add4f67257b49c819cf9d3ecb88c5faad190a99291fb46835fb313a8e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exe
Filesize
11KB

MD5
3ab3ae9095771d7b47462294bd24b0e9

SHA1
bede31e2bf5afefddfdf380867a3afdf4063dbdc

SHA256
0d8d47ef7871160b0df12bac466c8d822c69e43bca6213d8b6f2b5d4cb138d04

SHA512
4a6bc2361e6a70cf31a852a222ca7069c470abc63803642e3ad8ca979d8285028fab1ff2f4cef5c05b5894c7b85826f92dd931408aaab1b081ed25b1413a3c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1797546.exe
Filesize
11KB

MD5
3ab3ae9095771d7b47462294bd24b0e9

SHA1
bede31e2bf5afefddfdf380867a3afdf4063dbdc

SHA256
0d8d47ef7871160b0df12bac466c8d822c69e43bca6213d8b6f2b5d4cb138d04

SHA512
4a6bc2361e6a70cf31a852a222ca7069c470abc63803642e3ad8ca979d8285028fab1ff2f4cef5c05b5894c7b85826f92dd931408aaab1b081ed25b1413a3c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exe
Filesize
172KB

MD5
e646f910bafa9bb56c244f04f434f91d

SHA1
7cda0311f4e9506526d95ffb7245a5d38aefb440

SHA256
c2e49a0b5a07e8f0a67ecdc9d628cf456c58e567f1edf7f2a807467d02620f76

SHA512
8b2002de1bde7f646d15961b9d7d70e899c61e0e6e27ec820c8dda64a9de7323a6d27d48d4d63309369d213447ed249bd2d1e33370a17678c85896deec12dae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9041074.exe
Filesize
172KB

MD5
e646f910bafa9bb56c244f04f434f91d

SHA1
7cda0311f4e9506526d95ffb7245a5d38aefb440

SHA256
c2e49a0b5a07e8f0a67ecdc9d628cf456c58e567f1edf7f2a807467d02620f76

SHA512
8b2002de1bde7f646d15961b9d7d70e899c61e0e6e27ec820c8dda64a9de7323a6d27d48d4d63309369d213447ed249bd2d1e33370a17678c85896deec12dae2

Download Submit
memory/1444-154-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/2828-159-0x0000000000520000-0x0000000000550000-memory.dmp

Filesize
192KB

Download
memory/2828-160-0x000000000A920000-0x000000000AF38000-memory.dmp

Filesize
6.1MB

Download
memory/2828-161-0x000000000A4A0000-0x000000000A5AA000-memory.dmp

Filesize
1.0MB

Download
memory/2828-162-0x000000000A3E0000-0x000000000A3F2000-memory.dmp

Filesize
72KB

Download
memory/2828-163-0x000000000A440000-0x000000000A47C000-memory.dmp

Filesize
240KB

Download
memory/2828-164-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/2828-165-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads