redline | f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff

General

Target

f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
Size

580KB
MD5

9be282d5f1ba5c7a440591e92704a0c2
SHA1

1b85129421448d153423d2cab125f0765d8b3a7a
SHA256

f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff
SHA512

49d2e45a4e6b875f67d5e0502882a5b2a54d46adcf2b9c04e72e92450633f13da59cee6f6f000771b0b3aded3440a2300af8e1e8490caf6201e41041b5837d7f
SSDEEP

12288:cMrfy90tXutLZHQS8Zj38EO2JKUBRRsVEUpCTKERvN:jyyWLPI4sJKIvUXCTDv

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a0292340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0292340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0292340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0292340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0292340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0292340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0292340.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v0221291.exev0627316.exea0292340.exeb8171212.exe

pid process

4208 v0221291.exe
4020 v0627316.exe
4280 a0292340.exe
512 b8171212.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a0292340.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0292340.exe

pid	process
4208	v0221291.exe
4020	v0627316.exe
4280	a0292340.exe
512	b8171212.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0292340.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v0221291.exev0627316.exef5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0221291.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0627316.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0627316.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0221291.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a0292340.exe

pid process

4280 a0292340.exe
4280 a0292340.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a0292340.exe

description pid process

Token: SeDebugPrivilege 4280 a0292340.exe

pid	process
4280	a0292340.exe
4280	a0292340.exe

description	pid	process
Token: SeDebugPrivilege	4280	a0292340.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exev0221291.exev0627316.exe

description	pid	process	target process
PID 1200 wrote to memory of 4208	1200	f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe	v0221291.exe
PID 1200 wrote to memory of 4208	1200	f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe	v0221291.exe
PID 1200 wrote to memory of 4208	1200	f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe	v0221291.exe
PID 4208 wrote to memory of 4020	4208	v0221291.exe	v0627316.exe
PID 4208 wrote to memory of 4020	4208	v0221291.exe	v0627316.exe
PID 4208 wrote to memory of 4020	4208	v0221291.exe	v0627316.exe
PID 4020 wrote to memory of 4280	4020	v0627316.exe	a0292340.exe
PID 4020 wrote to memory of 4280	4020	v0627316.exe	a0292340.exe
PID 4020 wrote to memory of 512	4020	v0627316.exe	b8171212.exe
PID 4020 wrote to memory of 512	4020	v0627316.exe	b8171212.exe
PID 4020 wrote to memory of 512	4020	v0627316.exe	b8171212.exe

C:\Users\Admin\AppData\Local\Temp\f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe
"C:\Users\Admin\AppData\Local\Temp\f5aff3952c538af0d1826d698399aad8d7fe8de73ed200714b9735c851fab4ff.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exe
4⤵
- Executes dropped EXE
PID:512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exe
Filesize
378KB

MD5
def38113f0ae84d3d0368d13296f1496

SHA1
4ad242401ba0ec0edb0420e3736de57083b95e6a

SHA256
b2da4b52afa3da32a78204434bd1879d4d19b58fa1b61d33c618688fa45cb8ee

SHA512
390598b662445e9d3974b54dc200284006410ab76f405514b62e83bd691d130b38185d7d9b496581b5d043bbc77b578e6aa4edd458f39a08a28b9e125cddc19c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0221291.exe
Filesize
378KB

MD5
def38113f0ae84d3d0368d13296f1496

SHA1
4ad242401ba0ec0edb0420e3736de57083b95e6a

SHA256
b2da4b52afa3da32a78204434bd1879d4d19b58fa1b61d33c618688fa45cb8ee

SHA512
390598b662445e9d3974b54dc200284006410ab76f405514b62e83bd691d130b38185d7d9b496581b5d043bbc77b578e6aa4edd458f39a08a28b9e125cddc19c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exe
Filesize
206KB

MD5
6f2ffde5440f207e8f23589072b88e07

SHA1
3dcd5768357d52b1d53f4cca78618c662c821b90

SHA256
141bdacfdce008831c593363fd6badf5914eff908d55c71c4d4e2bc066e5fcad

SHA512
2a42a4cc414717bd8ce271019707c1f71d5455e616c18c3954a097d1b321334b946cdd0bebe366008c638308251dc69616c7008a9ec0fa7e22930ed4df8d85ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0627316.exe
Filesize
206KB

MD5
6f2ffde5440f207e8f23589072b88e07

SHA1
3dcd5768357d52b1d53f4cca78618c662c821b90

SHA256
141bdacfdce008831c593363fd6badf5914eff908d55c71c4d4e2bc066e5fcad

SHA512
2a42a4cc414717bd8ce271019707c1f71d5455e616c18c3954a097d1b321334b946cdd0bebe366008c638308251dc69616c7008a9ec0fa7e22930ed4df8d85ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exe
Filesize
11KB

MD5
3b13abc3a4ea1ebc54c5d519b61f6cfc

SHA1
7914024ffcf0337609973a7e00d4c3f6750b11f8

SHA256
db128aa1b144a15460d96ee541f9f33f0bbf3c85792e9f81117e1985dec8c35e

SHA512
efbf7300313877e098dc432c3304ba354c6f3fc4749a55c9c412c6c32add185f661a3feca4b15aef943bf6c58ff0df11497285a04c5d8343f00e374e0f1224ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0292340.exe
Filesize
11KB

MD5
3b13abc3a4ea1ebc54c5d519b61f6cfc

SHA1
7914024ffcf0337609973a7e00d4c3f6750b11f8

SHA256
db128aa1b144a15460d96ee541f9f33f0bbf3c85792e9f81117e1985dec8c35e

SHA512
efbf7300313877e098dc432c3304ba354c6f3fc4749a55c9c412c6c32add185f661a3feca4b15aef943bf6c58ff0df11497285a04c5d8343f00e374e0f1224ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exe
Filesize
172KB

MD5
ecec36a4a4e263b1a764f219ea441e57

SHA1
16fe09c484b69d2fee537819851fd204525b44aa

SHA256
a23863cd7efc82ae463049ddc4fbb52672bcae91adeeba395ecd31832475ff5b

SHA512
f9a319e2bb415389a75af0fd965bf4f9ae979b663be48dbf6a643cc9e4cbeb564072dae3ebd20ed8d1d808550bb86de9e3be7d4e0c47e4752f7fd439701248a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8171212.exe
Filesize
172KB

MD5
ecec36a4a4e263b1a764f219ea441e57

SHA1
16fe09c484b69d2fee537819851fd204525b44aa

SHA256
a23863cd7efc82ae463049ddc4fbb52672bcae91adeeba395ecd31832475ff5b

SHA512
f9a319e2bb415389a75af0fd965bf4f9ae979b663be48dbf6a643cc9e4cbeb564072dae3ebd20ed8d1d808550bb86de9e3be7d4e0c47e4752f7fd439701248a4

Download Submit
memory/512-159-0x0000000000080000-0x00000000000B0000-memory.dmp

Filesize
192KB

Download
memory/512-160-0x000000000A4C0000-0x000000000AAD8000-memory.dmp

Filesize
6.1MB

Download
memory/512-161-0x000000000A000000-0x000000000A10A000-memory.dmp

Filesize
1.0MB

Download
memory/512-162-0x0000000009F40000-0x0000000009F52000-memory.dmp

Filesize
72KB

Download
memory/512-163-0x0000000009FA0000-0x0000000009FDC000-memory.dmp

Filesize
240KB

Download
memory/512-164-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/512-165-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/4280-154-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads