redline | d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988

Analysis

max time kernel
56s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
05-06-2023 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe
Size

729KB
MD5

48eca29d7556a5cc08229cd4fc9ba5d2
SHA1

0c14043e4aa1e944a10ee2780b3a8d550af7fbef
SHA256

d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988
SHA512

be364bb23aa3fc5b33d5205f32d36ecc08e3c3039844560cc6f59006acf7a24fb8b795beb034dfcb9706b6d5f6ebb4d662226bcd1bddced45f312d012f3b88ff
SSDEEP

12288:qMrKy90rZ4kpvm21J1sBgxunHFeeSD1Eb9lEss6lBEOmiZgekFE5J+84:8yflQRxYIeWyb9dfEDiqekkB4

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exea9519469.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9519469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9519469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9519469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9519469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9519469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v1645069.exev3540426.exev2806881.exea9519469.exeb3399551.exec5201134.exe

pid process

3784 v1645069.exe
4128 v3540426.exe
3568 v2806881.exe
5040 a9519469.exe
4192 b3399551.exe
4016 c5201134.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a9519469.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9519469.exe

pid	process
3784	v1645069.exe
4128	v3540426.exe
3568	v2806881.exe
5040	a9519469.exe
4192	b3399551.exe
4016	c5201134.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9519469.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v1645069.exev3540426.exev2806881.exed3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1645069.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1645069.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3540426.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3540426.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2806881.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v2806881.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3399551.exe

description pid process target process

PID 4192 set thread context of 984 4192 b3399551.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

68 4016 WerFault.exe c5201134.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a9519469.exeAppLaunch.exe

pid process

5040 a9519469.exe
5040 a9519469.exe
984 AppLaunch.exe
984 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a9519469.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 5040 a9519469.exe
Token: SeDebugPrivilege 984 AppLaunch.exe

description	pid	process	target process
PID 4192 set thread context of 984	4192	b3399551.exe	AppLaunch.exe

pid	pid_target	process	target process
68	4016	WerFault.exe	c5201134.exe

pid	process
5040	a9519469.exe
5040	a9519469.exe
984	AppLaunch.exe
984	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	5040	a9519469.exe
Token: SeDebugPrivilege	984	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exev1645069.exev3540426.exev2806881.exeb3399551.exe

description	pid	process	target process
PID 2928 wrote to memory of 3784	2928	d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe	v1645069.exe
PID 2928 wrote to memory of 3784	2928	d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe	v1645069.exe
PID 2928 wrote to memory of 3784	2928	d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe	v1645069.exe
PID 3784 wrote to memory of 4128	3784	v1645069.exe	v3540426.exe
PID 3784 wrote to memory of 4128	3784	v1645069.exe	v3540426.exe
PID 3784 wrote to memory of 4128	3784	v1645069.exe	v3540426.exe
PID 4128 wrote to memory of 3568	4128	v3540426.exe	v2806881.exe
PID 4128 wrote to memory of 3568	4128	v3540426.exe	v2806881.exe
PID 4128 wrote to memory of 3568	4128	v3540426.exe	v2806881.exe
PID 3568 wrote to memory of 5040	3568	v2806881.exe	a9519469.exe
PID 3568 wrote to memory of 5040	3568	v2806881.exe	a9519469.exe
PID 3568 wrote to memory of 4192	3568	v2806881.exe	b3399551.exe
PID 3568 wrote to memory of 4192	3568	v2806881.exe	b3399551.exe
PID 3568 wrote to memory of 4192	3568	v2806881.exe	b3399551.exe
PID 4192 wrote to memory of 984	4192	b3399551.exe	AppLaunch.exe
PID 4192 wrote to memory of 984	4192	b3399551.exe	AppLaunch.exe
PID 4192 wrote to memory of 984	4192	b3399551.exe	AppLaunch.exe
PID 4192 wrote to memory of 984	4192	b3399551.exe	AppLaunch.exe
PID 4192 wrote to memory of 984	4192	b3399551.exe	AppLaunch.exe
PID 4128 wrote to memory of 4016	4128	v3540426.exe	c5201134.exe
PID 4128 wrote to memory of 4016	4128	v3540426.exe	c5201134.exe
PID 4128 wrote to memory of 4016	4128	v3540426.exe	c5201134.exe

C:\Users\Admin\AppData\Local\Temp\d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe
"C:\Users\Admin\AppData\Local\Temp\d3970f171d76ecca9cf98135d46b3e69ed05d7d58ef0d653c58c0913da421988.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4128

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3568

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exe
4⤵
- Executes dropped EXE
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 948
5⤵
- Program crash
PID:68

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exe
Filesize
526KB

MD5
c8c036027eb575b963c9c22e240bb77e

SHA1
8ec4cab28703532df5e7dae164b02e1d40d58d43

SHA256
9bb058e2668973fd9a71f783cf8e812acb52eb3f32517015ca5c4ea2cfccfba2

SHA512
a4fea2b971da189241dffc22612650544bb388550b98d3d6732236e6fb8c83ed0562dd50d86258be192b9b295719bf7085c5742d147f1b5e7cf5e42ce0850237

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1645069.exe
Filesize
526KB

MD5
c8c036027eb575b963c9c22e240bb77e

SHA1
8ec4cab28703532df5e7dae164b02e1d40d58d43

SHA256
9bb058e2668973fd9a71f783cf8e812acb52eb3f32517015ca5c4ea2cfccfba2

SHA512
a4fea2b971da189241dffc22612650544bb388550b98d3d6732236e6fb8c83ed0562dd50d86258be192b9b295719bf7085c5742d147f1b5e7cf5e42ce0850237

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exe
Filesize
354KB

MD5
48d4b0a1ab40175f3736ab15fdacb8a5

SHA1
898580bbb11e7e6fb39447b0ea565c55a5698853

SHA256
5369038872fb5a678e27c5f20446d4fa90de9c27b80e45b954aa6d9828cd9c01

SHA512
70d8f972e09d5597a5a45fe9cec05ca2a7becab4d3d83aa7eb9b112b48cdfa5eeab2b219a9f77f717bbfbbd58d144689d7c6f20a60328fb5298b16e5b9592e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3540426.exe
Filesize
354KB

MD5
48d4b0a1ab40175f3736ab15fdacb8a5

SHA1
898580bbb11e7e6fb39447b0ea565c55a5698853

SHA256
5369038872fb5a678e27c5f20446d4fa90de9c27b80e45b954aa6d9828cd9c01

SHA512
70d8f972e09d5597a5a45fe9cec05ca2a7becab4d3d83aa7eb9b112b48cdfa5eeab2b219a9f77f717bbfbbd58d144689d7c6f20a60328fb5298b16e5b9592e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exe
Filesize
172KB

MD5
7c69b60160775d770234f257ff7ea96f

SHA1
3af0a1cf28089b5b26d4e44c21bac6c9566d3d19

SHA256
eceafc9eaea0f2a730a4868106ca5d34d546e16eb36718f04951bf16c5f5d685

SHA512
dc1a17bba08b025b169c3a3f107cde195444834ad06fe13c3af0966b43f6df6c157157cb4e89815c679fc836547f413694157b55cc15c309f86fae1197ff5388

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5201134.exe
Filesize
172KB

MD5
7c69b60160775d770234f257ff7ea96f

SHA1
3af0a1cf28089b5b26d4e44c21bac6c9566d3d19

SHA256
eceafc9eaea0f2a730a4868106ca5d34d546e16eb36718f04951bf16c5f5d685

SHA512
dc1a17bba08b025b169c3a3f107cde195444834ad06fe13c3af0966b43f6df6c157157cb4e89815c679fc836547f413694157b55cc15c309f86fae1197ff5388

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exe
Filesize
199KB

MD5
d88a240a57f3739a500ff4f28498f491

SHA1
806602d7e24e7b886c3bcc8509f360f6c90040e7

SHA256
26803eba804332858bc742ad41317b1ddfa1a8c3d4a0d1e38592ca853f1be136

SHA512
ce392f422d5e5505297834c1e67c40e1fd955c4454d1930f92de161d003d7b85f399d0b7a49f5547abb0c31f688f3a88dc9ae067f8cacefd3712e829fc5658d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2806881.exe
Filesize
199KB

MD5
d88a240a57f3739a500ff4f28498f491

SHA1
806602d7e24e7b886c3bcc8509f360f6c90040e7

SHA256
26803eba804332858bc742ad41317b1ddfa1a8c3d4a0d1e38592ca853f1be136

SHA512
ce392f422d5e5505297834c1e67c40e1fd955c4454d1930f92de161d003d7b85f399d0b7a49f5547abb0c31f688f3a88dc9ae067f8cacefd3712e829fc5658d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exe
Filesize
12KB

MD5
d6336bc87b48924191187e04ac34e392

SHA1
fd3aeef197332cda61bfc50ec37df50a51593dfa

SHA256
e3d29d97b3c8bae7ee296c03773976c248223b62a5a1f9eeeb8a83a0f89c5997

SHA512
573d6e69276c69533051d6bcfa9a7c3801b564b0323c73b03deed031ebefcdf5ed67f5af9be137a7fc6c94cb944e9960e62d79236a3bd9701fc5a867e99afa10

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9519469.exe
Filesize
12KB

MD5
d6336bc87b48924191187e04ac34e392

SHA1
fd3aeef197332cda61bfc50ec37df50a51593dfa

SHA256
e3d29d97b3c8bae7ee296c03773976c248223b62a5a1f9eeeb8a83a0f89c5997

SHA512
573d6e69276c69533051d6bcfa9a7c3801b564b0323c73b03deed031ebefcdf5ed67f5af9be137a7fc6c94cb944e9960e62d79236a3bd9701fc5a867e99afa10

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exe
Filesize
105KB

MD5
df49c15f6ef18121bdcf2f7698d76e00

SHA1
744d461f98bba8452bf978bfda1d31c3d0c0e000

SHA256
c272817aec3bdcf4e8a62872d22b6f850e29823e3044e921b6609da3353d5714

SHA512
3dccc43e279613b08071c483e5683b851fcae5f742863967f8a2844c5d1f0f0bbfb51020debaeb6f9251a527aa8f1f0c5fd63f5b70d8556ab5a71df013978011

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3399551.exe
Filesize
105KB

MD5
df49c15f6ef18121bdcf2f7698d76e00

SHA1
744d461f98bba8452bf978bfda1d31c3d0c0e000

SHA256
c272817aec3bdcf4e8a62872d22b6f850e29823e3044e921b6609da3353d5714

SHA512
3dccc43e279613b08071c483e5683b851fcae5f742863967f8a2844c5d1f0f0bbfb51020debaeb6f9251a527aa8f1f0c5fd63f5b70d8556ab5a71df013978011

Download Submit
memory/984-154-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4016-165-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

Filesize
192KB

Download
memory/5040-149-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download