redline | b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed

General

Target

b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe
Size

580KB
MD5

5d029a3a6db1cfefb1d5d08a71939a57
SHA1

e56aa2fec42c492d3d60eb8bd303442ae65413b9
SHA256

b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed
SHA512

973d37a48d581a94c778dbdf386c5d463eed9a2bb2bdfdf266b437afd6cb08e4b2368697a0c5aa20bdf6656195db9514507e53c1a5056b845e51917834a0320f
SSDEEP

12288:+Mr5y903rYdpMOHDrIbJdxA5PzNPCLCT1k72p:Ly0ETMOPIfxA5PZ6LCmM

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k3926869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3926869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3926869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3926869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3926869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3926869.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
324	y9504625.exe
4496	y8089603.exe
1932	k3926869.exe
1120	l5578106.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3926869.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9504625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9504625.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8089603.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8089603.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1932	k3926869.exe
1932	k3926869.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe
1120	l5578106.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	k3926869.exe
Token: SeDebugPrivilege	1120	l5578106.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 324	1944	b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe	86
PID 1944 wrote to memory of 324	1944	b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe	86
PID 1944 wrote to memory of 324	1944	b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe	86
PID 324 wrote to memory of 4496	324	y9504625.exe	87
PID 324 wrote to memory of 4496	324	y9504625.exe	87
PID 324 wrote to memory of 4496	324	y9504625.exe	87
PID 4496 wrote to memory of 1932	4496	y8089603.exe	88
PID 4496 wrote to memory of 1932	4496	y8089603.exe	88
PID 4496 wrote to memory of 1120	4496	y8089603.exe	89
PID 4496 wrote to memory of 1120	4496	y8089603.exe	89
PID 4496 wrote to memory of 1120	4496	y8089603.exe	89

C:\Users\Admin\AppData\Local\Temp\b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe
"C:\Users\Admin\AppData\Local\Temp\b9bd9bd0a4b59d5e8e2ab1653fd711d34519d182ff779302f78810c06e109eed.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504625.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504625.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8089603.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8089603.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3926869.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3926869.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5578106.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5578106.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504625.exe

Filesize
377KB

MD5
5615c0c1e9ad688b8fd1f561149482fc

SHA1
9c227671920881e6144d2f836b03374644c45fbe

SHA256
862cc3ba2ae2fc097a26608323ca4bdc959b282eeeae55f144e1d0b7ef2e86af

SHA512
2b10f25e71f95a368cf77d4a4371678ec54aa9918fe4e74780248496696b4b0cc66a8450eaca9e7fdc7844a9aef1cc4b242688dc14cbff154c484410ef8553bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504625.exe

Filesize
377KB

MD5
5615c0c1e9ad688b8fd1f561149482fc

SHA1
9c227671920881e6144d2f836b03374644c45fbe

SHA256
862cc3ba2ae2fc097a26608323ca4bdc959b282eeeae55f144e1d0b7ef2e86af

SHA512
2b10f25e71f95a368cf77d4a4371678ec54aa9918fe4e74780248496696b4b0cc66a8450eaca9e7fdc7844a9aef1cc4b242688dc14cbff154c484410ef8553bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8089603.exe

Filesize
206KB

MD5
de2a039451ede206e53614636b2d7673

SHA1
dee67ff138f1796e6b2484edc3f1595a82df7c4a

SHA256
079943b0e1ae7986bd80f91a4f88531c0bcaa74526798a101e69a7f8b69a57c5

SHA512
8a09622082fa89258645155f7b3e9bc5f5c091c04a5a16676f305878f15f078f48a589ce9e1576558b4d83e4099dbc1bde1af73832fa1b4214c14f64a7d1eba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8089603.exe

Filesize
206KB

MD5
de2a039451ede206e53614636b2d7673

SHA1
dee67ff138f1796e6b2484edc3f1595a82df7c4a

SHA256
079943b0e1ae7986bd80f91a4f88531c0bcaa74526798a101e69a7f8b69a57c5

SHA512
8a09622082fa89258645155f7b3e9bc5f5c091c04a5a16676f305878f15f078f48a589ce9e1576558b4d83e4099dbc1bde1af73832fa1b4214c14f64a7d1eba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3926869.exe

Filesize
12KB

MD5
ec6a49e3433c5eec9aafca187547e6c9

SHA1
09a0bcdea91a480aaba06d0fae6fc96b41259a52

SHA256
6f73eddae0f8b9d7a8aa0de9a10f8703fd5802218bf34dfb1ce0d881673b9858

SHA512
1b1b98cb8c47d727f4b5d481befcbe061f72e3a6d3091466844d60b12f7e5bff7a648aec399dc14664a2e475f52d72fd2306a16a0a8cbd13fc0c7e8edc4fd515

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3926869.exe

Filesize
12KB

MD5
ec6a49e3433c5eec9aafca187547e6c9

SHA1
09a0bcdea91a480aaba06d0fae6fc96b41259a52

SHA256
6f73eddae0f8b9d7a8aa0de9a10f8703fd5802218bf34dfb1ce0d881673b9858

SHA512
1b1b98cb8c47d727f4b5d481befcbe061f72e3a6d3091466844d60b12f7e5bff7a648aec399dc14664a2e475f52d72fd2306a16a0a8cbd13fc0c7e8edc4fd515

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5578106.exe

Filesize
173KB

MD5
9107c67e3cca08ffdc3ff6927bf2025b

SHA1
8e680c8243eb31b4970dbbaebf2c1bec58a2cb17

SHA256
44c3d71db35767deffb8f6ba4bcd9058b982bbc4d097a97316232e5722772142

SHA512
749ec11735155a56416f48911d75dc14a2116493c5ef7695e69f4e9f3db079dbc9129d20c0995ff531f0e942165183c2cccaaaf7543bc86a04a962453467221d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5578106.exe

Filesize
173KB

MD5
9107c67e3cca08ffdc3ff6927bf2025b

SHA1
8e680c8243eb31b4970dbbaebf2c1bec58a2cb17

SHA256
44c3d71db35767deffb8f6ba4bcd9058b982bbc4d097a97316232e5722772142

SHA512
749ec11735155a56416f48911d75dc14a2116493c5ef7695e69f4e9f3db079dbc9129d20c0995ff531f0e942165183c2cccaaaf7543bc86a04a962453467221d

Download Submit
memory/1120-160-0x000000000B030000-0x000000000B648000-memory.dmp

Filesize
6.1MB

Download
memory/1120-165-0x000000000AF40000-0x000000000AFB6000-memory.dmp

Filesize
472KB

Download
memory/1120-172-0x000000000CBC0000-0x000000000D0EC000-memory.dmp

Filesize
5.2MB

Download
memory/1120-161-0x000000000AB90000-0x000000000AC9A000-memory.dmp

Filesize
1.0MB

Download
memory/1120-162-0x000000000AAD0000-0x000000000AAE2000-memory.dmp

Filesize
72KB

Download
memory/1120-163-0x000000000AB30000-0x000000000AB6C000-memory.dmp

Filesize
240KB

Download
memory/1120-164-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/1120-159-0x0000000000C10000-0x0000000000C40000-memory.dmp

Filesize
192KB

Download
memory/1120-166-0x000000000B6F0000-0x000000000B782000-memory.dmp

Filesize
584KB

Download
memory/1120-167-0x000000000BD40000-0x000000000C2E4000-memory.dmp

Filesize
5.6MB

Download
memory/1120-168-0x000000000B650000-0x000000000B6B6000-memory.dmp

Filesize
408KB

Download
memory/1120-169-0x000000000BB60000-0x000000000BBB0000-memory.dmp

Filesize
320KB

Download
memory/1120-170-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/1120-171-0x000000000C4C0000-0x000000000C682000-memory.dmp

Filesize
1.8MB

Download
memory/1932-154-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads