redline | 90d3dcaf413c56e26a311ac721faadcf10d2f6c7ec20c28769b912868d4641cd

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 583KB
Sample230606-aawtaabc47
SHA256 90d3dcaf413c56e26a311ac721faadcf10d2f6c7ec20c28769b912868d4641cd
MD5 2b3915868feab230e5cafe4be69d8f95
SHA1 9793337f51c8ff22594272512c4d1eb3fd316e54
SHA512 81b926ba1e7c4e6e451f6088d5fb8992148ff6c93187f917ff9d55650ccd0d973ab6b131fc5b1ffa18ad777c64c1bf69830dac07160013e361db41a9a90f81a0
SSDEEP 12288:6MrhGy90zbOFJpYAborDc1+zK6DTvS/w04BJlgd9zUBvO6C6maX3P2VF:HGy2OrVorNrDTkw0hdNUBvvC4XfYF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k4343940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4343940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4343940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4343940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4343940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4343940.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2004	y4974338.exe
2204	y6428977.exe
1028	k4343940.exe
2852	l1622545.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4343940.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4974338.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6428977.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6428977.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4974338.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1028	k4343940.exe
1028	k4343940.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe
2852	l1622545.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	k4343940.exe
Token: SeDebugPrivilege	2852	l1622545.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2004	3260	file.exe	84
PID 3260 wrote to memory of 2004	3260	file.exe	84
PID 3260 wrote to memory of 2004	3260	file.exe	84
PID 2004 wrote to memory of 2204	2004	y4974338.exe	85
PID 2004 wrote to memory of 2204	2004	y4974338.exe	85
PID 2004 wrote to memory of 2204	2004	y4974338.exe	85
PID 2204 wrote to memory of 1028	2204	y6428977.exe	86
PID 2204 wrote to memory of 1028	2204	y6428977.exe	86
PID 2204 wrote to memory of 2852	2204	y6428977.exe	91
PID 2204 wrote to memory of 2852	2204	y6428977.exe	91
PID 2204 wrote to memory of 2852	2204	y6428977.exe	91

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4974338.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4974338.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6428977.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6428977.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4343940.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4343940.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1622545.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1622545.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y4974338.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4974338.exe
Size 377KB
SHA256 9e2b6a6f76edd55b35d64ec5180b833a9aec5f6248d33ee570613b7a6464e293
MD5 f344c3d85fd7f8dd830c1e3c116b440a
SHA1 357cced67076bd6ac83746c87fb23a61eb09083f
SHA512 e0b6108354c1424a3d21629c2b05632d293e6ac20305e6fd68c183556b9e36f2f1d7cf8b4fe5319a38f798003a9744ec0705c3a0480fa4f77ce988800c795d35
SSDEEP 6144:Kmy+bnr+Ip0yN90QEABOpe3PgkWcnZNvBVami9cbc1+zK6vqRvQR/pBQ04BJloMM:+Mrky90he/gIc1+zK6yRvS/k04BJlZds
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4974338.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4974338.exe
Size 377KB
SHA256 9e2b6a6f76edd55b35d64ec5180b833a9aec5f6248d33ee570613b7a6464e293
MD5 f344c3d85fd7f8dd830c1e3c116b440a
SHA1 357cced67076bd6ac83746c87fb23a61eb09083f
SHA512 e0b6108354c1424a3d21629c2b05632d293e6ac20305e6fd68c183556b9e36f2f1d7cf8b4fe5319a38f798003a9744ec0705c3a0480fa4f77ce988800c795d35
SSDEEP 6144:Kmy+bnr+Ip0yN90QEABOpe3PgkWcnZNvBVami9cbc1+zK6vqRvQR/pBQ04BJloMM:+Mrky90he/gIc1+zK6yRvS/k04BJlZds
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6428977.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6428977.exe
Size 206KB
SHA256 631255f1c7fc9ee7bd0bb43d03702139c383cb209e143f8b42acdc94d96b516f
MD5 0833ff31f3199c7afd9fc37f9d9a355a
SHA1 ffac4f0e9874fa49a0e49c29ed9426ee68807cfa
SHA512 496841efb3b7f82538fdc899279ea83879d2caf4a790706c013d9553bdcd6b6d24070b8ff42bc875a53826fbacbec120596e3717c1d1f4ed2b0b22eb2a51b591
SSDEEP 3072:K8y+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk1oUBTQu7TZPSI+UIVhBoC:K8y+bnr+Ip0yN90QEcQu7TZP1+PbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6428977.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6428977.exe
Size 206KB
SHA256 631255f1c7fc9ee7bd0bb43d03702139c383cb209e143f8b42acdc94d96b516f
MD5 0833ff31f3199c7afd9fc37f9d9a355a
SHA1 ffac4f0e9874fa49a0e49c29ed9426ee68807cfa
SHA512 496841efb3b7f82538fdc899279ea83879d2caf4a790706c013d9553bdcd6b6d24070b8ff42bc875a53826fbacbec120596e3717c1d1f4ed2b0b22eb2a51b591
SSDEEP 3072:K8y+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk1oUBTQu7TZPSI+UIVhBoC:K8y+bnr+Ip0yN90QEcQu7TZP1+PbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

k4343940.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4343940.exe
Size 12KB
SHA256 41b74be862dd53ab711d0d7bd8f49e0f361c086c5ba3129c6b07afa56cc8ec5b
MD5 75f7daec52760093c00cc3d34c07e762
SHA1 c8d4aee2496ed8a9eca38eaaeadbbba4a4da5a64
SHA512 ff655a04719a6a3f5d270fcb3e0ba30ae4b9fc759251d73f430edf35800f3f0cf85b4fd2dd969237351f96520f0eae39600a24744195f57f290979cfb3972638
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k4343940.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4343940.exe
Size 12KB
SHA256 41b74be862dd53ab711d0d7bd8f49e0f361c086c5ba3129c6b07afa56cc8ec5b
MD5 75f7daec52760093c00cc3d34c07e762
SHA1 c8d4aee2496ed8a9eca38eaaeadbbba4a4da5a64
SHA512 ff655a04719a6a3f5d270fcb3e0ba30ae4b9fc759251d73f430edf35800f3f0cf85b4fd2dd969237351f96520f0eae39600a24744195f57f290979cfb3972638
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1622545.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1622545.exe
Size 172KB
SHA256 2ae25aeb032fb1e5eda2e1952761a2fdc7f023121e7e856405837d57b3dd29a4
MD5 25bfbed53cbbc7cb74737b1413950445
SHA1 8539dc7b70a6b59cfa29c950cb57979775bfa3e5
SHA512 41eb8f870ef66a303bbacb939c65bfedfe1ee8e96ae7d6cdc08152157da41f1a459db6ba7e4176728b1c15cd6713b52189724b5c4dbc0e05ed4d5493180a9344
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1622545.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1622545.exe
Size 172KB
SHA256 2ae25aeb032fb1e5eda2e1952761a2fdc7f023121e7e856405837d57b3dd29a4
MD5 25bfbed53cbbc7cb74737b1413950445
SHA1 8539dc7b70a6b59cfa29c950cb57979775bfa3e5
SHA512 41eb8f870ef66a303bbacb939c65bfedfe1ee8e96ae7d6cdc08152157da41f1a459db6ba7e4176728b1c15cd6713b52189724b5c4dbc0e05ed4d5493180a9344
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-154-0x0000000000090000-0x000000000009A000-memory.dmp

Download

memory/2852-160-0x000000000AA70000-0x000000000B088000-memory.dmp

Download

memory/2852-166-0x000000000A970000-0x000000000AA02000-memory.dmp

Download

memory/2852-161-0x000000000A5A0000-0x000000000A6AA000-memory.dmp

Download

memory/2852-162-0x000000000A4E0000-0x000000000A4F2000-memory.dmp

Download

memory/2852-163-0x000000000A540000-0x000000000A57C000-memory.dmp

Download

memory/2852-164-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/2852-165-0x000000000A850000-0x000000000A8C6000-memory.dmp

Download

memory/2852-159-0x0000000000620000-0x0000000000650000-memory.dmp

Download

memory/2852-167-0x000000000B640000-0x000000000BBE4000-memory.dmp

Download

memory/2852-168-0x000000000B190000-0x000000000B1F6000-memory.dmp

Download

memory/2852-169-0x000000000B570000-0x000000000B5C0000-memory.dmp

Download

memory/2852-170-0x000000000BEC0000-0x000000000C082000-memory.dmp

Download

memory/2852-171-0x000000000C5C0000-0x000000000CAEC000-memory.dmp

Download

memory/2852-172-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download