redline | 007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7

General

Target

007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe
Size

581KB
MD5

389d226267d1dfb960beba6228bd2ec6
SHA1

f9a0610c05903d24e707c79f3cf928e587a62049
SHA256

007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7
SHA512

129a68517e9049c7a18884cf7b76530a0d480bd722d6b9d53b185dc847c697ceee44b96ece593b19d3664d452337cd9c60bd5aa9b20291e6dd566eebd457254f
SSDEEP

12288:5Mriy90iSjE7RNg8js95azbSGVvjZDVphc8d2puDz:TypKuaSb9HVpmkTz

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k7471450.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k7471450.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k7471450.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k7471450.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k7471450.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4116	y2687788.exe
3324	y0009012.exe
2552	k7471450.exe
1004	l5728673.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k7471450.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2687788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2687788.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0009012.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0009012.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	k7471450.exe
2552	k7471450.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	k7471450.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4116	3200	007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe	66
PID 3200 wrote to memory of 4116	3200	007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe	66
PID 3200 wrote to memory of 4116	3200	007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe	66
PID 4116 wrote to memory of 3324	4116	y2687788.exe	67
PID 4116 wrote to memory of 3324	4116	y2687788.exe	67
PID 4116 wrote to memory of 3324	4116	y2687788.exe	67
PID 3324 wrote to memory of 2552	3324	y0009012.exe	68
PID 3324 wrote to memory of 2552	3324	y0009012.exe	68
PID 3324 wrote to memory of 1004	3324	y0009012.exe	69
PID 3324 wrote to memory of 1004	3324	y0009012.exe	69
PID 3324 wrote to memory of 1004	3324	y0009012.exe	69

C:\Users\Admin\AppData\Local\Temp\007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe
"C:\Users\Admin\AppData\Local\Temp\007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2687788.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2687788.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0009012.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0009012.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7471450.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7471450.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5728673.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5728673.exe
      4⤵
      Executes dropped EXE
      PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2687788.exe

Filesize
377KB

MD5
ae3dede6078ac27be6cdef2a017592a9

SHA1
6e032c21ddac9f299843b928e8dd114bde214164

SHA256
a6721b9502bbbf38977b29e61fa5674ac9f39e5ec4dd2f6a073b6ed645937dd7

SHA512
d93a1756dab58a8f3477e0e08cb993de91c4bb0bdfb446e0b9d67fcb60714c3146b461674897050604fcea3cff2c5e22ad09b5f205a62e9792aff834b9bb1531

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2687788.exe

Filesize
377KB

MD5
ae3dede6078ac27be6cdef2a017592a9

SHA1
6e032c21ddac9f299843b928e8dd114bde214164

SHA256
a6721b9502bbbf38977b29e61fa5674ac9f39e5ec4dd2f6a073b6ed645937dd7

SHA512
d93a1756dab58a8f3477e0e08cb993de91c4bb0bdfb446e0b9d67fcb60714c3146b461674897050604fcea3cff2c5e22ad09b5f205a62e9792aff834b9bb1531

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0009012.exe

Filesize
206KB

MD5
bddabd120b031d691188bddd79222e18

SHA1
e4416335b33f59da85f13d4abfe5d81fe53e161e

SHA256
b6fa3270186424c235ae7c3ddab0900ab702ac69278e38155562707eb85b681d

SHA512
a29727520c89c2302078c8e4509555482f150c45de68c114cc813a2212d2f16c7471331fb521609ca9b025aecd11874b76b4fbdeebff530586c9b7c02a0f1336

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0009012.exe

Filesize
206KB

MD5
bddabd120b031d691188bddd79222e18

SHA1
e4416335b33f59da85f13d4abfe5d81fe53e161e

SHA256
b6fa3270186424c235ae7c3ddab0900ab702ac69278e38155562707eb85b681d

SHA512
a29727520c89c2302078c8e4509555482f150c45de68c114cc813a2212d2f16c7471331fb521609ca9b025aecd11874b76b4fbdeebff530586c9b7c02a0f1336

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7471450.exe

Filesize
12KB

MD5
0725622adb7f1fb5978c1a604ab971af

SHA1
bb24eb84092f6980ddeeb21244a68c94e347aed1

SHA256
f151bb4da2d7a74b1bbddaac6c0e3f65dd034950c34665dc60189b6fca02fa67

SHA512
082684d47957f5502c03335573959604e2c8b3245e7e375c40ed7a0e770bbe4ac18a560404e32f4d9b3c104c2a3a80c88b16c7cebdbac4c2446dfecb3e506c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7471450.exe

Filesize
12KB

MD5
0725622adb7f1fb5978c1a604ab971af

SHA1
bb24eb84092f6980ddeeb21244a68c94e347aed1

SHA256
f151bb4da2d7a74b1bbddaac6c0e3f65dd034950c34665dc60189b6fca02fa67

SHA512
082684d47957f5502c03335573959604e2c8b3245e7e375c40ed7a0e770bbe4ac18a560404e32f4d9b3c104c2a3a80c88b16c7cebdbac4c2446dfecb3e506c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5728673.exe

Filesize
172KB

MD5
b8a04797eebe36d96ab2111b558dd4ac

SHA1
d7f4c0d9c0177210afa9daa1b89cecc9240955fa

SHA256
b2eb109a262e7bd937e1def907a585cfc03fbe609b8d1ddddd6100330e4e0dda

SHA512
0ba9ffb38dbf2f6b6c7d8a292f5006a6b529a72a5f7832681b691a5ba78b0d22d23b26caad23db9e67d69558e0c7a5be08ce4fd2128f50ba5a7cf66617933c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5728673.exe

Filesize
172KB

MD5
b8a04797eebe36d96ab2111b558dd4ac

SHA1
d7f4c0d9c0177210afa9daa1b89cecc9240955fa

SHA256
b2eb109a262e7bd937e1def907a585cfc03fbe609b8d1ddddd6100330e4e0dda

SHA512
0ba9ffb38dbf2f6b6c7d8a292f5006a6b529a72a5f7832681b691a5ba78b0d22d23b26caad23db9e67d69558e0c7a5be08ce4fd2128f50ba5a7cf66617933c0d

Download Submit
memory/1004-147-0x0000000000540000-0x0000000000570000-memory.dmp

Filesize
192KB

Download
memory/1004-148-0x0000000004DF0000-0x0000000004DF6000-memory.dmp

Filesize
24KB

Download
memory/1004-149-0x0000000005480000-0x0000000005A86000-memory.dmp

Filesize
6.0MB

Download
memory/1004-150-0x0000000004F80000-0x000000000508A000-memory.dmp

Filesize
1.0MB

Download
memory/1004-151-0x0000000004E40000-0x0000000004E52000-memory.dmp

Filesize
72KB

Download
memory/1004-152-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/1004-153-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

Filesize
248KB

Download
memory/1004-154-0x0000000004F00000-0x0000000004F4B000-memory.dmp

Filesize
300KB

Download
memory/1004-155-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/2552-142-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads