redline | 815481e49866ad19d437c62da9f6dd94761cb0644f19d8e2f5248e52b63edd89

General

Target

file.exe
Size

580KB
MD5

2eb76d4e6e7c584147d0b573573a81e1
SHA1

267520fc7483b4932cb2491fd4acf471b137d227
SHA256

815481e49866ad19d437c62da9f6dd94761cb0644f19d8e2f5248e52b63edd89
SHA512

2a2a6fe5fd63a9deda1963551b47ff0360cc2202d8173e9abf7c8b569e22df1de4a0d8fceae4b423b33e110bd8ab7eabbde5762c3ed7588644a0a9f28271aec5
SSDEEP

12288:zMrxy90htVdtsh2w7KnDuAcdr8G2RKnGAzTuvzT16yBm:ayq3tsh2w2nJciRRaGIyvv17U

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a1913767.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1913767.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1913767.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1913767.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1913767.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1913767.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1913767.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v5259303.exev7482734.exea1913767.exeb8312136.exe

pid process

3348 v5259303.exe
4564 v7482734.exe
4520 a1913767.exe
4236 b8312136.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a1913767.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a1913767.exe

pid	process
3348	v5259303.exe
4564	v7482734.exe
4520	a1913767.exe
4236	b8312136.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1913767.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exev5259303.exev7482734.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5259303.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5259303.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7482734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7482734.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1913767.exe

pid process

4520 a1913767.exe
4520 a1913767.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1913767.exe

description pid process

Token: SeDebugPrivilege 4520 a1913767.exe

pid	process
4520	a1913767.exe
4520	a1913767.exe

description	pid	process
Token: SeDebugPrivilege	4520	a1913767.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

file.exev5259303.exev7482734.exe

description	pid	process	target process
PID 4816 wrote to memory of 3348	4816	file.exe	v5259303.exe
PID 4816 wrote to memory of 3348	4816	file.exe	v5259303.exe
PID 4816 wrote to memory of 3348	4816	file.exe	v5259303.exe
PID 3348 wrote to memory of 4564	3348	v5259303.exe	v7482734.exe
PID 3348 wrote to memory of 4564	3348	v5259303.exe	v7482734.exe
PID 3348 wrote to memory of 4564	3348	v5259303.exe	v7482734.exe
PID 4564 wrote to memory of 4520	4564	v7482734.exe	a1913767.exe
PID 4564 wrote to memory of 4520	4564	v7482734.exe	a1913767.exe
PID 4564 wrote to memory of 4236	4564	v7482734.exe	b8312136.exe
PID 4564 wrote to memory of 4236	4564	v7482734.exe	b8312136.exe
PID 4564 wrote to memory of 4236	4564	v7482734.exe	b8312136.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4816

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5259303.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5259303.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3348

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7482734.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7482734.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1913767.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1913767.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8312136.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8312136.exe
4⤵
- Executes dropped EXE
PID:4236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5259303.exe

Filesize
377KB

MD5
f453131bde2b4c462c9384d33dad3159

SHA1
2b3fa7cc00a3e806f6ecd1463581f159cc1ca01e

SHA256
9da27a113f5869dd306f61dcae9d93b35035a5dbcdcf98cb74cee9436e19ae0b

SHA512
8f297c691427070b0c9e5b353490059c98af5b0fd757c1a48e713b17b495f3c656661f155a8cb9adca9d000e1ac10e7a3556d29a5aa612a906ef503c4c29efa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5259303.exe

Filesize
377KB

MD5
f453131bde2b4c462c9384d33dad3159

SHA1
2b3fa7cc00a3e806f6ecd1463581f159cc1ca01e

SHA256
9da27a113f5869dd306f61dcae9d93b35035a5dbcdcf98cb74cee9436e19ae0b

SHA512
8f297c691427070b0c9e5b353490059c98af5b0fd757c1a48e713b17b495f3c656661f155a8cb9adca9d000e1ac10e7a3556d29a5aa612a906ef503c4c29efa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7482734.exe

Filesize
206KB

MD5
95255a4afa945ce83cabbab0c3617c3e

SHA1
96360d8b10da5bb25a5965b9a556a90ba24afea0

SHA256
e5c531c343a6b71cb818c0701d5483407e74298b7664817b890e5a992c837171

SHA512
ea08b1910f46b4775bea617e92fab86288b27da86ec93c7d4e8df38218bb165ad9474a60c4674e8e912c6e5bb518f84595d5442d6b752bf4994036edead6e1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7482734.exe

Filesize
206KB

MD5
95255a4afa945ce83cabbab0c3617c3e

SHA1
96360d8b10da5bb25a5965b9a556a90ba24afea0

SHA256
e5c531c343a6b71cb818c0701d5483407e74298b7664817b890e5a992c837171

SHA512
ea08b1910f46b4775bea617e92fab86288b27da86ec93c7d4e8df38218bb165ad9474a60c4674e8e912c6e5bb518f84595d5442d6b752bf4994036edead6e1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1913767.exe

Filesize
11KB

MD5
ba97a3550b2e12405de53fb87ee74ac3

SHA1
c49a8f18ec1f06c81d43105ca9f709633d263b67

SHA256
08affa40ce8427a36a74c7389c34b3024154c82a6e99ee28288ee5b2bda10fd8

SHA512
ebac208032742df209375fc6645e675782aa9a58aca709c0c90a5a1aecef3d17946d7e2b9d4129d597f701fc63feb6fe6d207d8701b0740686914b5f6b5ea851

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1913767.exe

Filesize
11KB

MD5
ba97a3550b2e12405de53fb87ee74ac3

SHA1
c49a8f18ec1f06c81d43105ca9f709633d263b67

SHA256
08affa40ce8427a36a74c7389c34b3024154c82a6e99ee28288ee5b2bda10fd8

SHA512
ebac208032742df209375fc6645e675782aa9a58aca709c0c90a5a1aecef3d17946d7e2b9d4129d597f701fc63feb6fe6d207d8701b0740686914b5f6b5ea851

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8312136.exe

Filesize
172KB

MD5
83095f87c2ae23a9bb80423aa916762a

SHA1
c1908817fbd13fbdf4ed79ef9c4890da1597ecd1

SHA256
a0de8fc5fc69de645d31b00b42fa0f7aab1a57234e629c6636fc21fb7137b6b8

SHA512
41a56096aeb707df9d04664b966c8b053dc2c22c766f028afdfe0efd2581b39b870ccaa1a06f29ca95bae76faba5526cb1146e516211b9d31de040135ca360ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8312136.exe

Filesize
172KB

MD5
83095f87c2ae23a9bb80423aa916762a

SHA1
c1908817fbd13fbdf4ed79ef9c4890da1597ecd1

SHA256
a0de8fc5fc69de645d31b00b42fa0f7aab1a57234e629c6636fc21fb7137b6b8

SHA512
41a56096aeb707df9d04664b966c8b053dc2c22c766f028afdfe0efd2581b39b870ccaa1a06f29ca95bae76faba5526cb1146e516211b9d31de040135ca360ea

Download Submit
memory/4236-159-0x0000000000840000-0x0000000000870000-memory.dmp

Filesize
192KB

Download
memory/4236-160-0x000000000AC70000-0x000000000B288000-memory.dmp

Filesize
6.1MB

Download
memory/4236-161-0x000000000A7C0000-0x000000000A8CA000-memory.dmp

Filesize
1.0MB

Download
memory/4236-162-0x000000000A700000-0x000000000A712000-memory.dmp

Filesize
72KB

Download
memory/4236-163-0x000000000A760000-0x000000000A79C000-memory.dmp

Filesize
240KB

Download
memory/4236-164-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/4236-165-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/4520-154-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads