redline | 341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937

Analysis

max time kernel
45s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2023 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
Size

734KB
MD5

b914bf56ca71dc6cf88cab0d99c56b4b
SHA1

f28d6f9c338c968471bda88f8d42b39aaf4815a8
SHA256

341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937
SHA512

7c78770a511a62273b370b815e1b6722cff193e2a771e6236c073244fba172a6817dcc0634c5d43735f93edfabb1a0286a5316cfd8ea5768fff0115dc513f080
SSDEEP

12288:AMrsy90IRNXRnLR+RYD4xngWI9B3j2JNXZ9gZnX7zuHqkjjIdU2HJUD2SOp:cyhRlpLR7mntI9BoNvhPj32KNOp

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a9780356.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a9780356.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9780356.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9780356.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9780356.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9780356.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9780356.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v8369176.exev6438101.exev8755728.exea9780356.exeb4043778.exec5629529.exe

pid process

5104 v8369176.exe
4696 v6438101.exe
3132 v8755728.exe
4360 a9780356.exe
3364 b4043778.exe
1208 c5629529.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a9780356.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9780356.exe

pid	process
5104	v8369176.exe
4696	v6438101.exe
3132	v8755728.exe
4360	a9780356.exe
3364	b4043778.exe
1208	c5629529.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9780356.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v6438101.exev8755728.exe341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exev8369176.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6438101.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8755728.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8755728.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8369176.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8369176.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6438101.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

b4043778.exe

description pid process target process

PID 3364 set thread context of 4748 3364 b4043778.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 3364 WerFault.exe b4043778.exe

description	pid	process	target process
PID 3364 set thread context of 4748	3364	b4043778.exe	AppLaunch.exe

pid	pid_target	process	target process
3940	3364	WerFault.exe	b4043778.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

a9780356.exeAppLaunch.exec5629529.exe

pid	process
4360	a9780356.exe
4360	a9780356.exe
4748	AppLaunch.exe
4748	AppLaunch.exe
1208	c5629529.exe
1208	c5629529.exe
1208	c5629529.exe
1208	c5629529.exe
1208	c5629529.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a9780356.exeAppLaunch.exec5629529.exe

description pid process

Token: SeDebugPrivilege 4360 a9780356.exe
Token: SeDebugPrivilege 4748 AppLaunch.exe
Token: SeDebugPrivilege 1208 c5629529.exe

description	pid	process
Token: SeDebugPrivilege	4360	a9780356.exe
Token: SeDebugPrivilege	4748	AppLaunch.exe
Token: SeDebugPrivilege	1208	c5629529.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exev8369176.exev6438101.exev8755728.exeb4043778.exe

description	pid	process	target process
PID 3952 wrote to memory of 5104	3952	341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe	v8369176.exe
PID 3952 wrote to memory of 5104	3952	341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe	v8369176.exe
PID 3952 wrote to memory of 5104	3952	341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe	v8369176.exe
PID 5104 wrote to memory of 4696	5104	v8369176.exe	v6438101.exe
PID 5104 wrote to memory of 4696	5104	v8369176.exe	v6438101.exe
PID 5104 wrote to memory of 4696	5104	v8369176.exe	v6438101.exe
PID 4696 wrote to memory of 3132	4696	v6438101.exe	v8755728.exe
PID 4696 wrote to memory of 3132	4696	v6438101.exe	v8755728.exe
PID 4696 wrote to memory of 3132	4696	v6438101.exe	v8755728.exe
PID 3132 wrote to memory of 4360	3132	v8755728.exe	a9780356.exe
PID 3132 wrote to memory of 4360	3132	v8755728.exe	a9780356.exe
PID 3132 wrote to memory of 3364	3132	v8755728.exe	b4043778.exe
PID 3132 wrote to memory of 3364	3132	v8755728.exe	b4043778.exe
PID 3132 wrote to memory of 3364	3132	v8755728.exe	b4043778.exe
PID 3364 wrote to memory of 4748	3364	b4043778.exe	AppLaunch.exe
PID 3364 wrote to memory of 4748	3364	b4043778.exe	AppLaunch.exe
PID 3364 wrote to memory of 4748	3364	b4043778.exe	AppLaunch.exe
PID 3364 wrote to memory of 4748	3364	b4043778.exe	AppLaunch.exe
PID 3364 wrote to memory of 4748	3364	b4043778.exe	AppLaunch.exe
PID 4696 wrote to memory of 1208	4696	v6438101.exe	c5629529.exe
PID 4696 wrote to memory of 1208	4696	v6438101.exe	c5629529.exe
PID 4696 wrote to memory of 1208	4696	v6438101.exe	c5629529.exe

C:\Users\Admin\AppData\Local\Temp\341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe
"C:\Users\Admin\AppData\Local\Temp\341378f10c992e7900c77d77d640aa3462552c668ae6421432e38f89fc960937.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3952

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5104

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4696

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 216
6⤵
- Program crash
PID:3940

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3364 -ip 3364
1⤵
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exe
Filesize
530KB

MD5
2565f0fbdc8ec1632829c2b12b9c613b

SHA1
80970fa81fc9ffd973946ac6c4a77a5531bf73b9

SHA256
e910862dedc1c70e7c84ee3dbf66da9f043080359ca25ffdf2f5850cdae5070f

SHA512
0d3027a1ea7055b3f442e3bb2a8278d9406be4017c6e49a42901cc0affde74003068e4211e76965f7a07d1b331986486a6fd5fffd3960ef8956f63de1da43201

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8369176.exe
Filesize
530KB

MD5
2565f0fbdc8ec1632829c2b12b9c613b

SHA1
80970fa81fc9ffd973946ac6c4a77a5531bf73b9

SHA256
e910862dedc1c70e7c84ee3dbf66da9f043080359ca25ffdf2f5850cdae5070f

SHA512
0d3027a1ea7055b3f442e3bb2a8278d9406be4017c6e49a42901cc0affde74003068e4211e76965f7a07d1b331986486a6fd5fffd3960ef8956f63de1da43201

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exe
Filesize
357KB

MD5
a0ec82d43ff9b21477b9d676f4822282

SHA1
255704ce2dbf833745afeebb54d9f88cac7f2c9c

SHA256
90907396f2df68d3e22dcf39c5e6274baad6fd6718e512bf8c2455d2966f19a9

SHA512
7007acccb76fc0580567803d8ae572208170c12b9ad2f4e1e31a097a837fce3922920c28fb8178126093f7e762b08bc526a6590434bd3b242b416f3509efa3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6438101.exe
Filesize
357KB

MD5
a0ec82d43ff9b21477b9d676f4822282

SHA1
255704ce2dbf833745afeebb54d9f88cac7f2c9c

SHA256
90907396f2df68d3e22dcf39c5e6274baad6fd6718e512bf8c2455d2966f19a9

SHA512
7007acccb76fc0580567803d8ae572208170c12b9ad2f4e1e31a097a837fce3922920c28fb8178126093f7e762b08bc526a6590434bd3b242b416f3509efa3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exe
Filesize
172KB

MD5
4ef79be7d11626605516e0eec9a29508

SHA1
0163ee73c04177742f471d5ad04aefbb94c68ff9

SHA256
2ea7442857497666002889df8cfb8b9c77e64a900b9b43ba2e3b9ebcb9463fb8

SHA512
f7e497a394746927ab057b3b2ab3566dd68122756b496faa17451d1789e549cad28b46d66c67f6a1878be191a7a4627d0286cf8096c0a0f7b271ad90d51f225d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5629529.exe
Filesize
172KB

MD5
4ef79be7d11626605516e0eec9a29508

SHA1
0163ee73c04177742f471d5ad04aefbb94c68ff9

SHA256
2ea7442857497666002889df8cfb8b9c77e64a900b9b43ba2e3b9ebcb9463fb8

SHA512
f7e497a394746927ab057b3b2ab3566dd68122756b496faa17451d1789e549cad28b46d66c67f6a1878be191a7a4627d0286cf8096c0a0f7b271ad90d51f225d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exe
Filesize
202KB

MD5
a9a058967d290ec1e03e9d1353f86bb9

SHA1
1560b2ac0d3399af68bf8e64b3121da8716d2e57

SHA256
589b9711832e9ac4edeaf25cf75edbcab1a3e8f0f34c26be00a06eab1a71aa00

SHA512
585329aef8027244666d85860fc5a9b117bf841feefc9142d436f0c93d888fb31bd6c39044e0f8ae979d13064e2979c5d3d94a6aace2d1c804fb9c9358590b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8755728.exe
Filesize
202KB

MD5
a9a058967d290ec1e03e9d1353f86bb9

SHA1
1560b2ac0d3399af68bf8e64b3121da8716d2e57

SHA256
589b9711832e9ac4edeaf25cf75edbcab1a3e8f0f34c26be00a06eab1a71aa00

SHA512
585329aef8027244666d85860fc5a9b117bf841feefc9142d436f0c93d888fb31bd6c39044e0f8ae979d13064e2979c5d3d94a6aace2d1c804fb9c9358590b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exe
Filesize
12KB

MD5
7c54c74def66969ea23e92d3aa8271c6

SHA1
8fb5470c63caad82094ff94d5503405ceeeead95

SHA256
f9e08f4d91232719e55875369d032cf75a8b68946663f5209ee44d12085fdc9e

SHA512
73c404e489f9a909bdb8717ae2cbe79e583fb7d7ec592935eb870fd756b62326a00bb64440e8d594571679793cf1647bb6febb88b579320f2b97b03f489af7d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9780356.exe
Filesize
12KB

MD5
7c54c74def66969ea23e92d3aa8271c6

SHA1
8fb5470c63caad82094ff94d5503405ceeeead95

SHA256
f9e08f4d91232719e55875369d032cf75a8b68946663f5209ee44d12085fdc9e

SHA512
73c404e489f9a909bdb8717ae2cbe79e583fb7d7ec592935eb870fd756b62326a00bb64440e8d594571679793cf1647bb6febb88b579320f2b97b03f489af7d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exe
Filesize
117KB

MD5
c98688d5f72d8e7bba3eb6a0529c06f3

SHA1
9f236ba957be3580c293cf171757f3a46f20ab41

SHA256
d38b1392f7f113fe1934f1ee2b5aea462631c6c8c44871459333cb51b9a2ea91

SHA512
1eed377bf810688c5a60056bc0cf0edd8fac1bb670d5b7d8e80568c808248e1770be93d671be30e4f130f2697f2b8684b017928d2d8ee4842996e77ad2de7c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4043778.exe
Filesize
117KB

MD5
c98688d5f72d8e7bba3eb6a0529c06f3

SHA1
9f236ba957be3580c293cf171757f3a46f20ab41

SHA256
d38b1392f7f113fe1934f1ee2b5aea462631c6c8c44871459333cb51b9a2ea91

SHA512
1eed377bf810688c5a60056bc0cf0edd8fac1bb670d5b7d8e80568c808248e1770be93d671be30e4f130f2697f2b8684b017928d2d8ee4842996e77ad2de7c68

Download Submit
memory/1208-175-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/1208-180-0x0000000009F70000-0x0000000009FAC000-memory.dmp

Filesize
240KB

Download
memory/1208-189-0x000000000B080000-0x000000000B0D0000-memory.dmp

Filesize
320KB

Download
memory/1208-176-0x000000000A4A0000-0x000000000AAB8000-memory.dmp

Filesize
6.1MB

Download
memory/1208-177-0x0000000009FD0000-0x000000000A0DA000-memory.dmp

Filesize
1.0MB

Download
memory/1208-178-0x0000000009F10000-0x0000000009F22000-memory.dmp

Filesize
72KB

Download
memory/1208-179-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/1208-188-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/1208-181-0x000000000A280000-0x000000000A2F6000-memory.dmp

Filesize
472KB

Download
memory/1208-182-0x000000000A3A0000-0x000000000A432000-memory.dmp

Filesize
584KB

Download
memory/1208-183-0x000000000B170000-0x000000000B714000-memory.dmp

Filesize
5.6MB

Download
memory/1208-184-0x000000000ABC0000-0x000000000AC26000-memory.dmp

Filesize
408KB

Download
memory/1208-186-0x000000000B8F0000-0x000000000BAB2000-memory.dmp

Filesize
1.8MB

Download
memory/1208-187-0x000000000BFF0000-0x000000000C51C000-memory.dmp

Filesize
5.2MB

Download
memory/4360-161-0x0000000000850000-0x000000000085A000-memory.dmp

Filesize
40KB

Download
memory/4748-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download