redline | 920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587

General

Target

920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
Size

580KB
MD5

e68bf83d4ba9d30b8139951cf3bdb70f
SHA1

c7403616495758559d4674d0b1b58849f29ee0fd
SHA256

920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
SHA512

db0a1666f0180a32d01b5204aecfa3aca2aecf59909683c569919d69c4c0de1ec16b72960d38dc607f37509dd503f296fa81f7c3951f69b9feb77f002c21ca63
SSDEEP

12288:jMrty90Rxy2d0MUSLqgoitl+ycBs0IpxdLymtrbylQ:6yGFz/nPtrpxVdxbyK

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a7704307.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7704307.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7704307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7704307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7704307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7704307.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7704307.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v2120122.exev3112633.exea7704307.exeb5426233.exe

pid process

3968 v2120122.exe
2716 v3112633.exe
3660 a7704307.exe
4536 b5426233.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a7704307.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7704307.exe

pid	process
3968	v2120122.exe
2716	v3112633.exe
3660	a7704307.exe
4536	b5426233.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7704307.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v3112633.exe920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exev2120122.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3112633.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3112633.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2120122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2120122.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

a7704307.exeb5426233.exe

pid	process
3660	a7704307.exe
3660	a7704307.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe
4536	b5426233.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a7704307.exeb5426233.exe

description pid process

Token: SeDebugPrivilege 3660 a7704307.exe
Token: SeDebugPrivilege 4536 b5426233.exe

description	pid	process
Token: SeDebugPrivilege	3660	a7704307.exe
Token: SeDebugPrivilege	4536	b5426233.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exev2120122.exev3112633.exe

description	pid	process	target process
PID 3260 wrote to memory of 3968	3260	920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe	v2120122.exe
PID 3260 wrote to memory of 3968	3260	920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe	v2120122.exe
PID 3260 wrote to memory of 3968	3260	920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe	v2120122.exe
PID 3968 wrote to memory of 2716	3968	v2120122.exe	v3112633.exe
PID 3968 wrote to memory of 2716	3968	v2120122.exe	v3112633.exe
PID 3968 wrote to memory of 2716	3968	v2120122.exe	v3112633.exe
PID 2716 wrote to memory of 3660	2716	v3112633.exe	a7704307.exe
PID 2716 wrote to memory of 3660	2716	v3112633.exe	a7704307.exe
PID 2716 wrote to memory of 4536	2716	v3112633.exe	b5426233.exe
PID 2716 wrote to memory of 4536	2716	v3112633.exe	b5426233.exe
PID 2716 wrote to memory of 4536	2716	v3112633.exe	b5426233.exe

C:\Users\Admin\AppData\Local\Temp\920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
"C:\Users\Admin\AppData\Local\Temp\920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3260

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exe
Filesize
377KB

MD5
f054cb0f1086f961b4abcfa33ab2e74c

SHA1
466fa191858aee7cb78af569959ccc520efa968a

SHA256
a056f9d0e344d66bfbe17d0cca164119c670bfc217fdaae2dc1b50b4e3c76f9c

SHA512
e791bcfd9eed4262aedd52a7ca78f1114eb461926c255e04dda7a69129614e43eeb827ea9770945f1e1c0a87943d340acbd933c95e783eb2e879214888a33011

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120122.exe
Filesize
377KB

MD5
f054cb0f1086f961b4abcfa33ab2e74c

SHA1
466fa191858aee7cb78af569959ccc520efa968a

SHA256
a056f9d0e344d66bfbe17d0cca164119c670bfc217fdaae2dc1b50b4e3c76f9c

SHA512
e791bcfd9eed4262aedd52a7ca78f1114eb461926c255e04dda7a69129614e43eeb827ea9770945f1e1c0a87943d340acbd933c95e783eb2e879214888a33011

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exe
Filesize
206KB

MD5
5d3610cb4583ec08cf78afd88d3c5529

SHA1
4330f4c4060792c85c719a660651b2c90ee0b3d7

SHA256
63a6f94c03411ffcea14ad5bae9ce839cb888b0967ed5631ba7cd624edd252b2

SHA512
8f85bbead23e2c39b26b87b4125771eb6d1a338d57733fe46e5c22840854e1c4607ee741b116795c3bce1d88d0e637f1a03c31adcf717e8e2e50790edf060136

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3112633.exe
Filesize
206KB

MD5
5d3610cb4583ec08cf78afd88d3c5529

SHA1
4330f4c4060792c85c719a660651b2c90ee0b3d7

SHA256
63a6f94c03411ffcea14ad5bae9ce839cb888b0967ed5631ba7cd624edd252b2

SHA512
8f85bbead23e2c39b26b87b4125771eb6d1a338d57733fe46e5c22840854e1c4607ee741b116795c3bce1d88d0e637f1a03c31adcf717e8e2e50790edf060136

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exe
Filesize
12KB

MD5
812d1b479d9531c44390b1a8089df61c

SHA1
3ebf6aab8f2bf78ad8a1a68e86e11a00bf443b7d

SHA256
fc0158b5b0750ee408ea393beea080a7601a7c5024882809713112c041f9da89

SHA512
e75466a5830d29bd7ef4d348306ffeea2cbfbf850e5020b16645b8d4e5779b271033a6a438438b0364179453ad19f3cc30be62bbf79865f92a7b6f535548cdd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7704307.exe
Filesize
12KB

MD5
812d1b479d9531c44390b1a8089df61c

SHA1
3ebf6aab8f2bf78ad8a1a68e86e11a00bf443b7d

SHA256
fc0158b5b0750ee408ea393beea080a7601a7c5024882809713112c041f9da89

SHA512
e75466a5830d29bd7ef4d348306ffeea2cbfbf850e5020b16645b8d4e5779b271033a6a438438b0364179453ad19f3cc30be62bbf79865f92a7b6f535548cdd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exe
Filesize
172KB

MD5
1c86c329124ff21195866c50818d531d

SHA1
9d954f3a8f0d95435af89975726c1820e26e31bb

SHA256
4be2c7fbc3e5bfc79264e199a20862a80669216afeab938a41e5e28700346f08

SHA512
bd62617f33e15d4362a781f12ec51633cccb998b5df53a575251ad16364a443d99c7f3fc01abcfbec35d4a71b43db685ed86d07ee507ec0300186c296be752cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5426233.exe
Filesize
172KB

MD5
1c86c329124ff21195866c50818d531d

SHA1
9d954f3a8f0d95435af89975726c1820e26e31bb

SHA256
4be2c7fbc3e5bfc79264e199a20862a80669216afeab938a41e5e28700346f08

SHA512
bd62617f33e15d4362a781f12ec51633cccb998b5df53a575251ad16364a443d99c7f3fc01abcfbec35d4a71b43db685ed86d07ee507ec0300186c296be752cf

Download Submit
memory/3660-154-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/4536-160-0x000000000B0B0000-0x000000000B6C8000-memory.dmp

Filesize
6.1MB

Download
memory/4536-166-0x000000000AFC0000-0x000000000B052000-memory.dmp

Filesize
584KB

Download
memory/4536-161-0x000000000ABF0000-0x000000000ACFA000-memory.dmp

Filesize
1.0MB

Download
memory/4536-162-0x000000000AB30000-0x000000000AB42000-memory.dmp

Filesize
72KB

Download
memory/4536-163-0x000000000AB90000-0x000000000ABCC000-memory.dmp

Filesize
240KB

Download
memory/4536-164-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/4536-165-0x000000000AEA0000-0x000000000AF16000-memory.dmp

Filesize
472KB

Download
memory/4536-159-0x0000000000C70000-0x0000000000CA0000-memory.dmp

Filesize
192KB

Download
memory/4536-167-0x000000000AF20000-0x000000000AF86000-memory.dmp

Filesize
408KB

Download
memory/4536-168-0x000000000C080000-0x000000000C624000-memory.dmp

Filesize
5.6MB

Download
memory/4536-169-0x000000000BCC0000-0x000000000BD10000-memory.dmp

Filesize
320KB

Download
memory/4536-170-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/4536-171-0x000000000C630000-0x000000000C7F2000-memory.dmp

Filesize
1.8MB

Download
memory/4536-172-0x000000000CD30000-0x000000000D25C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads