redline | 2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983

General

Target

2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
Size

580KB
MD5

74961b3d2ba94680dd0a8a9945ee46a4
SHA1

dab73096107320f74ca58566faffa5b35f3611b3
SHA256

2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983
SHA512

ec1122d3a25c143cc18ca945301a05630a98caf45e10c23fd28bfecc05c4d03c84592760d55a507bbe7317543f9c7ba0d99a896285d832b891a728a3f2df624b
SSDEEP

12288:KMrly90HrbY2eFUvPUkHgJHmGo/79NjcX1aIcX:nyi4liImGoZNYl+

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a3621933.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3621933.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3621933.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3621933.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3621933.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3621933.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3621933.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v0698900.exev4361474.exea3621933.exeb5056863.exe

pid process

2784 v0698900.exe
3188 v4361474.exe
1420 a3621933.exe
3856 b5056863.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a3621933.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3621933.exe

pid	process
2784	v0698900.exe
3188	v4361474.exe
1420	a3621933.exe
3856	b5056863.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3621933.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v4361474.exe2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exev0698900.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4361474.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0698900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0698900.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4361474.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3621933.exe

pid process

1420 a3621933.exe
1420 a3621933.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3621933.exe

description pid process

Token: SeDebugPrivilege 1420 a3621933.exe

pid	process
1420	a3621933.exe
1420	a3621933.exe

description	pid	process
Token: SeDebugPrivilege	1420	a3621933.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exev0698900.exev4361474.exe

description	pid	process	target process
PID 2936 wrote to memory of 2784	2936	2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe	v0698900.exe
PID 2936 wrote to memory of 2784	2936	2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe	v0698900.exe
PID 2936 wrote to memory of 2784	2936	2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe	v0698900.exe
PID 2784 wrote to memory of 3188	2784	v0698900.exe	v4361474.exe
PID 2784 wrote to memory of 3188	2784	v0698900.exe	v4361474.exe
PID 2784 wrote to memory of 3188	2784	v0698900.exe	v4361474.exe
PID 3188 wrote to memory of 1420	3188	v4361474.exe	a3621933.exe
PID 3188 wrote to memory of 1420	3188	v4361474.exe	a3621933.exe
PID 3188 wrote to memory of 3856	3188	v4361474.exe	b5056863.exe
PID 3188 wrote to memory of 3856	3188	v4361474.exe	b5056863.exe
PID 3188 wrote to memory of 3856	3188	v4361474.exe	b5056863.exe

C:\Users\Admin\AppData\Local\Temp\2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe
"C:\Users\Admin\AppData\Local\Temp\2fb6de4ff6816fe9db70ae103e31f39825c3e738180028431cc366d0d871d983.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3188

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exe
4⤵
- Executes dropped EXE
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exe
Filesize
377KB

MD5
3f3c791aa385ec170f4db00f85463cde

SHA1
408b8536deca2561957556fc5a3da384b4ae2dc6

SHA256
ad76330287b1b75fbbbf12216186b0dbd51130f0aef446b3975ceee8fe75725e

SHA512
dc421e581d82467ee52da3fef7975c5b3b4ec53fb423c56c5fc7a49a980d68c06baa98b5512d8d3206dbfe166583e8586030ceb36571936a0a51b7aafd6cb37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0698900.exe
Filesize
377KB

MD5
3f3c791aa385ec170f4db00f85463cde

SHA1
408b8536deca2561957556fc5a3da384b4ae2dc6

SHA256
ad76330287b1b75fbbbf12216186b0dbd51130f0aef446b3975ceee8fe75725e

SHA512
dc421e581d82467ee52da3fef7975c5b3b4ec53fb423c56c5fc7a49a980d68c06baa98b5512d8d3206dbfe166583e8586030ceb36571936a0a51b7aafd6cb37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exe
Filesize
206KB

MD5
ab357fe580c91b50e3a38a26b99502e1

SHA1
3924050cd4749ce6dfd538cb6f9345d093de8a02

SHA256
6efef4f1fcaabca315d0bc620812dfb5e80ee16992d5a258f7d7a0810cf3d1cd

SHA512
a15747bfe320e18fccbede76bab8b264405d1bae89e2c279af15c0639ef9b85aa1091b69a099537124a1ed7bc09fd0cef880f17748cb3fc06efd28642a97d197

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4361474.exe
Filesize
206KB

MD5
ab357fe580c91b50e3a38a26b99502e1

SHA1
3924050cd4749ce6dfd538cb6f9345d093de8a02

SHA256
6efef4f1fcaabca315d0bc620812dfb5e80ee16992d5a258f7d7a0810cf3d1cd

SHA512
a15747bfe320e18fccbede76bab8b264405d1bae89e2c279af15c0639ef9b85aa1091b69a099537124a1ed7bc09fd0cef880f17748cb3fc06efd28642a97d197

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exe
Filesize
11KB

MD5
97ac268fb02ea976d6c4045aa62edfe1

SHA1
f0734c5a446d420eccab629a61df860df59cba03

SHA256
e53c50f5300972cea9cb13404a80f3fd8f93ae5f01a5624c5541d3c7a34c8ee9

SHA512
ff1da3484c14825464c3f57dc07fb404af7a6ec517f86bc79d91fc568811ca8fea8443c451efe6e5fc791c5538c4252f163eae9dfe00f84e4ef1d0d141d97601

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3621933.exe
Filesize
11KB

MD5
97ac268fb02ea976d6c4045aa62edfe1

SHA1
f0734c5a446d420eccab629a61df860df59cba03

SHA256
e53c50f5300972cea9cb13404a80f3fd8f93ae5f01a5624c5541d3c7a34c8ee9

SHA512
ff1da3484c14825464c3f57dc07fb404af7a6ec517f86bc79d91fc568811ca8fea8443c451efe6e5fc791c5538c4252f163eae9dfe00f84e4ef1d0d141d97601

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exe
Filesize
172KB

MD5
c5ea1578bf294033b52fbaf454dd023f

SHA1
323be12e05558e17f4d83b740628d700fd2b1c10

SHA256
3461a7a3e0432ad4ed32db90eb2f8143e7b4089e1b92ebf014b4f7242071cad1

SHA512
de4993ee90017e7bd45400941d867540d3646740ab9fece9d39d41c313a17e2f25c6a41333cb7d36c1ae2993c79107bdc7a1c4dcae76019742a77de4dc28df37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5056863.exe
Filesize
172KB

MD5
c5ea1578bf294033b52fbaf454dd023f

SHA1
323be12e05558e17f4d83b740628d700fd2b1c10

SHA256
3461a7a3e0432ad4ed32db90eb2f8143e7b4089e1b92ebf014b4f7242071cad1

SHA512
de4993ee90017e7bd45400941d867540d3646740ab9fece9d39d41c313a17e2f25c6a41333cb7d36c1ae2993c79107bdc7a1c4dcae76019742a77de4dc28df37

Download Submit
memory/1420-154-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/3856-159-0x00000000000F0000-0x0000000000120000-memory.dmp

Filesize
192KB

Download
memory/3856-160-0x000000000A530000-0x000000000AB48000-memory.dmp

Filesize
6.1MB

Download
memory/3856-161-0x000000000A070000-0x000000000A17A000-memory.dmp

Filesize
1.0MB

Download
memory/3856-162-0x0000000009FB0000-0x0000000009FC2000-memory.dmp

Filesize
72KB

Download
memory/3856-163-0x000000000A010000-0x000000000A04C000-memory.dmp

Filesize
240KB

Download
memory/3856-164-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/3856-165-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads