redline | bf748ec3ec65b7b357c1724db3de2f6eeb7718ea83b0e42062fe2c6c71628244

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59d5d24142c291ab36293355b3b494f1.exe
Size 584KB
Sample230606-cl9wdsbf57
SHA256 bf748ec3ec65b7b357c1724db3de2f6eeb7718ea83b0e42062fe2c6c71628244
MD5 59d5d24142c291ab36293355b3b494f1
SHA1 d44221de701e710ecfc88de42b062c3d60a9a9b7
SHA512 e0d8716c512420101d37fdd7abc1aa831b03abc349021e520ecff517a6ecc931de1bf2538ad882969978c2395141d129fd85297054fb17ff25e8d5944d2add44
SSDEEP 12288:fMrsy90Fi3nvkvZF05CdC8FYQqgBM6NzEHkir5RLvqJ:ny0iXvOTdCyxW6NzUr/eJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5817947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5817947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5817947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5817947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5817947.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5817947.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
368	y1906865.exe
1912	y4271079.exe
1064	k5817947.exe
3992	l9546291.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5817947.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	59d5d24142c291ab36293355b3b494f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	59d5d24142c291ab36293355b3b494f1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y1906865.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1906865.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4271079.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4271079.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1064	k5817947.exe
1064	k5817947.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	k5817947.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 368	4112	59d5d24142c291ab36293355b3b494f1.exe	87
PID 4112 wrote to memory of 368	4112	59d5d24142c291ab36293355b3b494f1.exe	87
PID 4112 wrote to memory of 368	4112	59d5d24142c291ab36293355b3b494f1.exe	87
PID 368 wrote to memory of 1912	368	y1906865.exe	88
PID 368 wrote to memory of 1912	368	y1906865.exe	88
PID 368 wrote to memory of 1912	368	y1906865.exe	88
PID 1912 wrote to memory of 1064	1912	y4271079.exe	89
PID 1912 wrote to memory of 1064	1912	y4271079.exe	89
PID 1912 wrote to memory of 3992	1912	y4271079.exe	90
PID 1912 wrote to memory of 3992	1912	y4271079.exe	90
PID 1912 wrote to memory of 3992	1912	y4271079.exe	90

C:\Users\Admin\AppData\Local\Temp\59d5d24142c291ab36293355b3b494f1.exe
"C:\Users\Admin\AppData\Local\Temp\59d5d24142c291ab36293355b3b494f1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1906865.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1906865.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4271079.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4271079.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5817947.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5817947.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9546291.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9546291.exe
      4⤵
      Executes dropped EXE
      PID:3992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y1906865.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1906865.exe
Size 377KB
SHA256 18ef303323622dc4b3b233e40e21dfee87fedc223423d0e9d29576eabff8e3de
MD5 d6b459e7c309af25efc0a8c1e072c418
SHA1 cc5f0a9a27bf79f81f30f3260d43585cfe7808ad
SHA512 8989c944b99f15e2ddd0e4416ee9aa96ef73d6b7f40af1bc1bd1fa08305c654568753eaa19bf8e05f2eb12e5bed259c5f36ec1b0aad76fc611d39ac9eaf69be3
SSDEEP 6144:KTy+bnr+op0yN90QEKdvysj7qulM3PCLgyFCxCJo4nq1x4MI9eO+hj:5Mrgy90sdvv7quoCLJFoWq8BMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

y1906865.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1906865.exe
Size 377KB
SHA256 18ef303323622dc4b3b233e40e21dfee87fedc223423d0e9d29576eabff8e3de
MD5 d6b459e7c309af25efc0a8c1e072c418
SHA1 cc5f0a9a27bf79f81f30f3260d43585cfe7808ad
SHA512 8989c944b99f15e2ddd0e4416ee9aa96ef73d6b7f40af1bc1bd1fa08305c654568753eaa19bf8e05f2eb12e5bed259c5f36ec1b0aad76fc611d39ac9eaf69be3
SSDEEP 6144:KTy+bnr+op0yN90QEKdvysj7qulM3PCLgyFCxCJo4nq1x4MI9eO+hj:5Mrgy90sdvv7quoCLJFoWq8BMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4271079.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4271079.exe
Size 206KB
SHA256 6a47c34fac193f2e1e1f21d40aba1d6dfa77938f26ef84d6bac97fbdc33727d4
MD5 77774ec5d96d60566bb82a5e80841d5c
SHA1 ba0cf18d3c73e4a854ba32ccc04273dd0a67186c
SHA512 5a8b8e65c823c1fb5b5245722dd042e91b0441b9c583d5f52dd025b5d7d745303d89e31e1355e33aefdc29a7cca78a956de98cc2bba90e744d6c6a90e12060ab
SSDEEP 3072:KTy+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk11CdqVCrItg2AoR:KTy+bnr+Ap0yN90QEeBtgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4271079.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4271079.exe
Size 206KB
SHA256 6a47c34fac193f2e1e1f21d40aba1d6dfa77938f26ef84d6bac97fbdc33727d4
MD5 77774ec5d96d60566bb82a5e80841d5c
SHA1 ba0cf18d3c73e4a854ba32ccc04273dd0a67186c
SHA512 5a8b8e65c823c1fb5b5245722dd042e91b0441b9c583d5f52dd025b5d7d745303d89e31e1355e33aefdc29a7cca78a956de98cc2bba90e744d6c6a90e12060ab
SSDEEP 3072:KTy+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk11CdqVCrItg2AoR:KTy+bnr+Ap0yN90QEeBtgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5817947.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5817947.exe
Size 13KB
SHA256 c3ee7ae9aa11594f9ad00826c5b97f6ec70d3f4807540fc4444b4259fe2b9049
MD5 60aa6088f75cefccbb557a769cfd682d
SHA1 e4bd8bef423b04aa9185de6c6efc257861efd19a
SHA512 0f69fe2c76b9d7ab187ec1b717feef56a04cd73a8beadf1e01b05456b03b8320a6a08b746e2cf2608b58c3e148a78e22b0e96dbb02cecaa4cfa3eb73f1b887ef
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5817947.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5817947.exe
Size 13KB
SHA256 c3ee7ae9aa11594f9ad00826c5b97f6ec70d3f4807540fc4444b4259fe2b9049
MD5 60aa6088f75cefccbb557a769cfd682d
SHA1 e4bd8bef423b04aa9185de6c6efc257861efd19a
SHA512 0f69fe2c76b9d7ab187ec1b717feef56a04cd73a8beadf1e01b05456b03b8320a6a08b746e2cf2608b58c3e148a78e22b0e96dbb02cecaa4cfa3eb73f1b887ef
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9546291.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9546291.exe
Size 172KB
SHA256 9fd8ac4add3bf9e4e508c8c10b5240b5155c7f19e17a42edc11991360723c6ae
MD5 8493879ab161554ef2a3c39afacbb64f
SHA1 f1df65b10db56fd48e394be63780ce3d3fd160be
SHA512 978d491f25d46ed66489c8e092a268f16ee12735da82252d7284b54acb9e444ff348a75215a7c87f932cb0320b828f94d37ef5c274b1dbd81380a34493ccda5a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9546291.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9546291.exe
Size 172KB
SHA256 9fd8ac4add3bf9e4e508c8c10b5240b5155c7f19e17a42edc11991360723c6ae
MD5 8493879ab161554ef2a3c39afacbb64f
SHA1 f1df65b10db56fd48e394be63780ce3d3fd160be
SHA512 978d491f25d46ed66489c8e092a268f16ee12735da82252d7284b54acb9e444ff348a75215a7c87f932cb0320b828f94d37ef5c274b1dbd81380a34493ccda5a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1064-154-0x0000000000D80000-0x0000000000D8A000-memory.dmp

Download

memory/3992-159-0x0000000000680000-0x00000000006B0000-memory.dmp

Download

memory/3992-160-0x000000000AB90000-0x000000000B1A8000-memory.dmp

Download

memory/3992-161-0x000000000A680000-0x000000000A78A000-memory.dmp

Download

memory/3992-162-0x0000000002D70000-0x0000000002D82000-memory.dmp

Download

memory/3992-163-0x000000000A5B0000-0x000000000A5EC000-memory.dmp

Download

memory/3992-164-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/3992-165-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download