redline | 4b2eafaaa864645f665e47c8a81669e48cd109e828696ebbb9dfb8b4edc82be3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 584KB
Sample230606-aclq4abc57
SHA256 4b2eafaaa864645f665e47c8a81669e48cd109e828696ebbb9dfb8b4edc82be3
MD5 86c921db6798a284b97f489036e0bde2
SHA1 dd2c1b54ff6e0c4b72310ff5271d102681815607
SHA512 d2fd70f6d84b51e24c79417e100f1bd78d965aab3de286b5789361f12ff7ffab5a40821e1c11dd6b93086f3da3efe84189592892cb8edbb553275aef3029d4bd
SSDEEP 12288:pMrSy90YW1Lk9pLIx5OZAvxQpU+52QK5jQP04JRQK3uJprnaJguTZSsZm:LyW1wHIqZwaCXQ4QP04bQK3irnazZXZm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k1001923.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1001923.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1001923.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1001923.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1001923.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1001923.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
3500	y6084032.exe
4720	y5116211.exe
5116	k1001923.exe
3980	l3300269.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1001923.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6084032.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6084032.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y5116211.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5116211.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5116	k1001923.exe
5116	k1001923.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe
3980	l3300269.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	k1001923.exe
Token: SeDebugPrivilege	3980	l3300269.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3500	1180	file.exe	85
PID 1180 wrote to memory of 3500	1180	file.exe	85
PID 1180 wrote to memory of 3500	1180	file.exe	85
PID 3500 wrote to memory of 4720	3500	y6084032.exe	86
PID 3500 wrote to memory of 4720	3500	y6084032.exe	86
PID 3500 wrote to memory of 4720	3500	y6084032.exe	86
PID 4720 wrote to memory of 5116	4720	y5116211.exe	87
PID 4720 wrote to memory of 5116	4720	y5116211.exe	87
PID 4720 wrote to memory of 3980	4720	y5116211.exe	88
PID 4720 wrote to memory of 3980	4720	y5116211.exe	88
PID 4720 wrote to memory of 3980	4720	y5116211.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6084032.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6084032.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5116211.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5116211.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1001923.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1001923.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3300269.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3300269.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y6084032.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6084032.exe
Size 377KB
SHA256 f685c931b5aab3605ee8bb8d849824633a28d05bd57b2e1872c617d556bb46e9
MD5 ab2562cf2e528a693e60a55917c9c0f2
SHA1 6817854eb32dd384a3a37c9d6551b25fcefe5587
SHA512 26cfc95bb32ec714901862ffe815d2e9f2cdfccb4ccca32834a6cb724352928f67e96f1dd4b00898baa2ec61911d07673c031b860b8a44dfaf30462d4e02bb5b
SSDEEP 6144:Kiy+bnr+op0yN90QEcnqtJAfleyRX6xXAwDLVx5SQkOnH5jIUOQP04JRQfa2cqKl:qMrky90Wnq7AfQxQUVx5KQH5jFP04JRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6084032.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6084032.exe
Size 377KB
SHA256 f685c931b5aab3605ee8bb8d849824633a28d05bd57b2e1872c617d556bb46e9
MD5 ab2562cf2e528a693e60a55917c9c0f2
SHA1 6817854eb32dd384a3a37c9d6551b25fcefe5587
SHA512 26cfc95bb32ec714901862ffe815d2e9f2cdfccb4ccca32834a6cb724352928f67e96f1dd4b00898baa2ec61911d07673c031b860b8a44dfaf30462d4e02bb5b
SSDEEP 6144:Kiy+bnr+op0yN90QEcnqtJAfleyRX6xXAwDLVx5SQkOnH5jIUOQP04JRQfa2cqKl:qMrky90Wnq7AfQxQUVx5KQH5jFP04JRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

y5116211.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5116211.exe
Size 206KB
SHA256 8f5aeea7662972c7e7c0d713b62e2e2496392a5d646cd71a1fd0cec90f63cbf6
MD5 209ab0eb578ce7bd7f05885d4f2ab1a6
SHA1 84e94cefe842b359cd091827f971678bb79aff9a
SHA512 f8f093d6ca28b7ddfebb5d223f5ec83d04ee5814e1bddd665924641460b262c1e1c3f18369c3701726b53f3210f446c9e01f1c9f7af9ababac9f32831a7e50b5
SSDEEP 3072:KPy+bnr+O1D5GWp1icKAArDZz4N9GhbkrNEk1s1MksA4SDEvk/WtOHm/Ct+rPKsf:KPy+bnr+Ap0yN90QEskfDEvqWOHmKF
MD5 SHA1 SHA512 SSDEEP

Submit Download

y5116211.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5116211.exe
Size 206KB
SHA256 8f5aeea7662972c7e7c0d713b62e2e2496392a5d646cd71a1fd0cec90f63cbf6
MD5 209ab0eb578ce7bd7f05885d4f2ab1a6
SHA1 84e94cefe842b359cd091827f971678bb79aff9a
SHA512 f8f093d6ca28b7ddfebb5d223f5ec83d04ee5814e1bddd665924641460b262c1e1c3f18369c3701726b53f3210f446c9e01f1c9f7af9ababac9f32831a7e50b5
SSDEEP 3072:KPy+bnr+O1D5GWp1icKAArDZz4N9GhbkrNEk1s1MksA4SDEvk/WtOHm/Ct+rPKsf:KPy+bnr+Ap0yN90QEskfDEvqWOHmKF
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1001923.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1001923.exe
Size 12KB
SHA256 fe05668900dcb99ff68e8260a7dba68f993af4c7a1619f22b0e3bbe252ff0b80
MD5 29c0b9c24d8a72ddd106470ce9c14600
SHA1 4091d7aeaa5bf48a853ad69d6f03ec06a4f38a64
SHA512 caf54d2886c72a7d75aaa69f5c84797036448fdfdb9bc297e9dc3be0e9c22269a1520b72fbff148e67e62116e760e11b71421d673333c57a0c9a694c95f86b6e
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1001923.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1001923.exe
Size 12KB
SHA256 fe05668900dcb99ff68e8260a7dba68f993af4c7a1619f22b0e3bbe252ff0b80
MD5 29c0b9c24d8a72ddd106470ce9c14600
SHA1 4091d7aeaa5bf48a853ad69d6f03ec06a4f38a64
SHA512 caf54d2886c72a7d75aaa69f5c84797036448fdfdb9bc297e9dc3be0e9c22269a1520b72fbff148e67e62116e760e11b71421d673333c57a0c9a694c95f86b6e
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l3300269.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3300269.exe
Size 172KB
SHA256 c85df5d70b2fe041b996009e65a813147e1a6f4d0b0d74ec0ed8a3680965f670
MD5 ebbcf4f0311cc3c520506591a63448dc
SHA1 0e6fbfb35957a7951579c5e13fb710585ba5a03d
SHA512 09be6de39e57be17fdd9cc207f7cf3d0dbbaed198641dc9bc7a6800ccb3132814f54f7a0ad097cf0c30232df9d62f4d7feebe3800ee39e59fda88137c6591451
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l3300269.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3300269.exe
Size 172KB
SHA256 c85df5d70b2fe041b996009e65a813147e1a6f4d0b0d74ec0ed8a3680965f670
MD5 ebbcf4f0311cc3c520506591a63448dc
SHA1 0e6fbfb35957a7951579c5e13fb710585ba5a03d
SHA512 09be6de39e57be17fdd9cc207f7cf3d0dbbaed198641dc9bc7a6800ccb3132814f54f7a0ad097cf0c30232df9d62f4d7feebe3800ee39e59fda88137c6591451
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3980-160-0x000000000AE20000-0x000000000B438000-memory.dmp

Download

memory/3980-165-0x000000000ABB0000-0x000000000AC26000-memory.dmp

Download

memory/3980-172-0x000000000C0B0000-0x000000000C100000-memory.dmp

Download

memory/3980-161-0x000000000A910000-0x000000000AA1A000-memory.dmp

Download

memory/3980-162-0x000000000A840000-0x000000000A852000-memory.dmp

Download

memory/3980-163-0x000000000A8A0000-0x000000000A8DC000-memory.dmp

Download

memory/3980-164-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/3980-159-0x0000000000980000-0x00000000009B0000-memory.dmp

Download

memory/3980-166-0x000000000ACD0000-0x000000000AD62000-memory.dmp

Download

memory/3980-167-0x000000000B9F0000-0x000000000BF94000-memory.dmp

Download

memory/3980-168-0x000000000AD70000-0x000000000ADD6000-memory.dmp

Download

memory/3980-169-0x000000000C170000-0x000000000C332000-memory.dmp

Download

memory/3980-170-0x000000000C870000-0x000000000CD9C000-memory.dmp

Download

memory/3980-171-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/5116-154-0x0000000000440000-0x000000000044A000-memory.dmp

Download