redline | 17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a

General

Target

17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
Size

579KB
MD5

3761df12bebd38333cc8a961b6abfe2b
SHA1

30bde90e1ab6b292ebf71920b21849228d4f950a
SHA256

17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a
SHA512

6716576d6adc4acb7ffd66830395b82cde53d67dbcb97aa31104f6b33962610b98714fd4db4dbf86da61f79906a6e7401608c00fc2362bd74278f8dd061b06ad
SSDEEP

12288:IMrJy90Xlf0XKD7LauHVkRZMInGpfC9nOCMfPkjFNvS+:ByAlfUKDNJPfC9nOCMfMf6+

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a7015700.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7015700.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7015700.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7015700.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7015700.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7015700.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7015700.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v7610644.exev0458835.exea7015700.exeb6250151.exe

pid process

2408 v7610644.exe
1404 v0458835.exe
4596 a7015700.exe
4260 b6250151.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a7015700.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7015700.exe

pid	process
2408	v7610644.exe
1404	v0458835.exe
4596	a7015700.exe
4260	b6250151.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7015700.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exev7610644.exev0458835.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7610644.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7610644.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0458835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0458835.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7015700.exe

pid process

4596 a7015700.exe
4596 a7015700.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7015700.exe

description pid process

Token: SeDebugPrivilege 4596 a7015700.exe

pid	process
4596	a7015700.exe
4596	a7015700.exe

description	pid	process
Token: SeDebugPrivilege	4596	a7015700.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exev7610644.exev0458835.exe

description	pid	process	target process
PID 3080 wrote to memory of 2408	3080	17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe	v7610644.exe
PID 3080 wrote to memory of 2408	3080	17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe	v7610644.exe
PID 3080 wrote to memory of 2408	3080	17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe	v7610644.exe
PID 2408 wrote to memory of 1404	2408	v7610644.exe	v0458835.exe
PID 2408 wrote to memory of 1404	2408	v7610644.exe	v0458835.exe
PID 2408 wrote to memory of 1404	2408	v7610644.exe	v0458835.exe
PID 1404 wrote to memory of 4596	1404	v0458835.exe	a7015700.exe
PID 1404 wrote to memory of 4596	1404	v0458835.exe	a7015700.exe
PID 1404 wrote to memory of 4260	1404	v0458835.exe	b6250151.exe
PID 1404 wrote to memory of 4260	1404	v0458835.exe	b6250151.exe
PID 1404 wrote to memory of 4260	1404	v0458835.exe	b6250151.exe

C:\Users\Admin\AppData\Local\Temp\17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe
"C:\Users\Admin\AppData\Local\Temp\17fbdc887305e01bd6fc3ca93dbb2b50af8d8bb8135bda4a8b244107b991767a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3080

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exe
4⤵
- Executes dropped EXE
PID:4260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exe
Filesize
377KB

MD5
680bdda538ba2c8c5f16077f7c1aec4a

SHA1
af6995054d8622a1422569e2a48676db379a2bd3

SHA256
78a913eb8e6e672806fed1f46d1ddbd05795c4566ea84429061a5ad574edcce1

SHA512
98921eb0f8df88da184a736872e5de333abbba354798b174b17f815c8140c59028991b826e7c525ec8109e65fd92789199b51168fceeed3e7ab7f35ebb2be351

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7610644.exe
Filesize
377KB

MD5
680bdda538ba2c8c5f16077f7c1aec4a

SHA1
af6995054d8622a1422569e2a48676db379a2bd3

SHA256
78a913eb8e6e672806fed1f46d1ddbd05795c4566ea84429061a5ad574edcce1

SHA512
98921eb0f8df88da184a736872e5de333abbba354798b174b17f815c8140c59028991b826e7c525ec8109e65fd92789199b51168fceeed3e7ab7f35ebb2be351

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exe
Filesize
206KB

MD5
790eb418bd43765b31deb95a69de35dc

SHA1
12c17ad002f119b24d746d03fe9fe5e2bc4baa3f

SHA256
b5b0c56331252527533100950020d547e5dbc5ddb5dfc363dcbd7aad9f2c4352

SHA512
69106d782a2ffeebe2f46d28e823c270b8e0932a905b5f69d8415925cbc74c0e1e1e66f3a57b23c243710b2d4a8e1cb6ca489da3d4d0b5dfacf643cee80e948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0458835.exe
Filesize
206KB

MD5
790eb418bd43765b31deb95a69de35dc

SHA1
12c17ad002f119b24d746d03fe9fe5e2bc4baa3f

SHA256
b5b0c56331252527533100950020d547e5dbc5ddb5dfc363dcbd7aad9f2c4352

SHA512
69106d782a2ffeebe2f46d28e823c270b8e0932a905b5f69d8415925cbc74c0e1e1e66f3a57b23c243710b2d4a8e1cb6ca489da3d4d0b5dfacf643cee80e948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exe
Filesize
11KB

MD5
6adc836b8e5dbbdfc8c49d6418816921

SHA1
5b968ba5e97f672a755a2503d8d9162091744cb6

SHA256
ecf409d4195fda12593d9bf6067e1123722a98f0a400a414f8e90573d47b45d6

SHA512
bb1b28b20e90bdc7becf97fa116105144ec06f415d0c20d7bf4fe39346432ec29914b7019b323e66e4f91ecd5494646d0f999406021d17bb6f0b1734d6ca7e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7015700.exe
Filesize
11KB

MD5
6adc836b8e5dbbdfc8c49d6418816921

SHA1
5b968ba5e97f672a755a2503d8d9162091744cb6

SHA256
ecf409d4195fda12593d9bf6067e1123722a98f0a400a414f8e90573d47b45d6

SHA512
bb1b28b20e90bdc7becf97fa116105144ec06f415d0c20d7bf4fe39346432ec29914b7019b323e66e4f91ecd5494646d0f999406021d17bb6f0b1734d6ca7e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exe
Filesize
172KB

MD5
e2c373e03336f7e4df11ae12377c8490

SHA1
5dfe9aa87546ec6f3c26af07e882f403050aabb5

SHA256
865704f1846cc7e2f15838404ba890f1c15979f7056f08994ae654f790f19c7e

SHA512
8ee6005fcc149984d76e2424ad2aa33c7c5295b7c4aef454bf336a6b03a0819f06555ecd17f89625017ada11228e1ac24f4c6df981a095b3b3e46084acf9ada2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6250151.exe
Filesize
172KB

MD5
e2c373e03336f7e4df11ae12377c8490

SHA1
5dfe9aa87546ec6f3c26af07e882f403050aabb5

SHA256
865704f1846cc7e2f15838404ba890f1c15979f7056f08994ae654f790f19c7e

SHA512
8ee6005fcc149984d76e2424ad2aa33c7c5295b7c4aef454bf336a6b03a0819f06555ecd17f89625017ada11228e1ac24f4c6df981a095b3b3e46084acf9ada2

Download Submit
memory/4260-159-0x00000000005A0000-0x00000000005D0000-memory.dmp

Filesize
192KB

Download
memory/4260-160-0x000000000A9A0000-0x000000000AFB8000-memory.dmp

Filesize
6.1MB

Download
memory/4260-161-0x000000000A520000-0x000000000A62A000-memory.dmp

Filesize
1.0MB

Download
memory/4260-162-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/4260-163-0x000000000A460000-0x000000000A472000-memory.dmp

Filesize
72KB

Download
memory/4260-164-0x000000000A4C0000-0x000000000A4FC000-memory.dmp

Filesize
240KB

Download
memory/4260-165-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/4596-154-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads