redline | cc4a967f44d97c285dad9070945a709dc6e8b41a5b400b1c489d923c74611f6b

General

Target

53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe
Size

581KB
MD5

ff5d1e04d3ab7b200989a063c75e2461
SHA1

6088ab645636e8e954cbfead71308a6f56052d97
SHA256

53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e
SHA512

bc04cd141c9a9489234aafc4bd35aaa13a6b43679a8d96079a9e56136506bf3f652117b5e544028c53ae61d7af939f989eab7ffa1ed13146044858ecc3df7b71
SSDEEP

12288:8Mrky90O9+7mtSIoKH0XxaIVwomNUXpFs+5B4ZvO+uEs0CIPmsP:Qy1k7WEKMyUXpd5B4ZG+uX0COmsP

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a4012019.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4012019.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4012019.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4012019.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4012019.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a4012019.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4012019.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v8927430.exev6392619.exea4012019.exeb5184495.exe

pid process

5020 v8927430.exe
3992 v6392619.exe
1160 a4012019.exe
216 b5184495.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a4012019.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a4012019.exe

pid	process
5020	v8927430.exe
3992	v6392619.exe
1160	a4012019.exe
216	b5184495.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4012019.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exev8927430.exev6392619.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8927430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8927430.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6392619.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6392619.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4012019.exe

pid process

1160 a4012019.exe
1160 a4012019.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a4012019.exe

description pid process

Token: SeDebugPrivilege 1160 a4012019.exe

pid	process
1160	a4012019.exe
1160	a4012019.exe

description	pid	process
Token: SeDebugPrivilege	1160	a4012019.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exev8927430.exev6392619.exe

description	pid	process	target process
PID 3152 wrote to memory of 5020	3152	53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe	v8927430.exe
PID 3152 wrote to memory of 5020	3152	53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe	v8927430.exe
PID 3152 wrote to memory of 5020	3152	53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe	v8927430.exe
PID 5020 wrote to memory of 3992	5020	v8927430.exe	v6392619.exe
PID 5020 wrote to memory of 3992	5020	v8927430.exe	v6392619.exe
PID 5020 wrote to memory of 3992	5020	v8927430.exe	v6392619.exe
PID 3992 wrote to memory of 1160	3992	v6392619.exe	a4012019.exe
PID 3992 wrote to memory of 1160	3992	v6392619.exe	a4012019.exe
PID 3992 wrote to memory of 216	3992	v6392619.exe	b5184495.exe
PID 3992 wrote to memory of 216	3992	v6392619.exe	b5184495.exe
PID 3992 wrote to memory of 216	3992	v6392619.exe	b5184495.exe

C:\Users\Admin\AppData\Local\Temp\53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe
"C:\Users\Admin\AppData\Local\Temp\53e8c50e13111ea74fe9a0a315dc9311233c7bdde45702e80c40f168668a538e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8927430.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8927430.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5020

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6392619.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6392619.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4012019.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4012019.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5184495.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5184495.exe
4⤵
- Executes dropped EXE
PID:216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8927430.exe
Filesize
377KB

MD5
9e10117012d19841ff3641aa051363ee

SHA1
b5add5712375f58966fb01646d0c96e4031dd763

SHA256
343a93249c65cbfa0a30518bd5bd3b75353bce94c57aca97a1998d189d909980

SHA512
a132f6fc7723f88820de645efb9592a75beeccf84283d1a3668d716ee9754fa320ae66af7197650e186f8dded9b8833716ce7e689c5c7a719dd651a5f3fc7181

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8927430.exe
Filesize
377KB

MD5
9e10117012d19841ff3641aa051363ee

SHA1
b5add5712375f58966fb01646d0c96e4031dd763

SHA256
343a93249c65cbfa0a30518bd5bd3b75353bce94c57aca97a1998d189d909980

SHA512
a132f6fc7723f88820de645efb9592a75beeccf84283d1a3668d716ee9754fa320ae66af7197650e186f8dded9b8833716ce7e689c5c7a719dd651a5f3fc7181

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6392619.exe
Filesize
206KB

MD5
45eb4999184fbea0565929468db8b323

SHA1
a823c6bd2886a66dc534fdee80ed432b8f87555e

SHA256
6138f5763b9fd0a0203bbda64b42e5cae185a40fbd7f28520e16d40cf623c728

SHA512
3c77d31eaa5695bb63cd157a7f2a8d6c56b3c09e0ce50d93d9e29c98c1210444660955da0dd5606016c7ee4508ec5e32254f3db1d46b167287020227bf695b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6392619.exe
Filesize
206KB

MD5
45eb4999184fbea0565929468db8b323

SHA1
a823c6bd2886a66dc534fdee80ed432b8f87555e

SHA256
6138f5763b9fd0a0203bbda64b42e5cae185a40fbd7f28520e16d40cf623c728

SHA512
3c77d31eaa5695bb63cd157a7f2a8d6c56b3c09e0ce50d93d9e29c98c1210444660955da0dd5606016c7ee4508ec5e32254f3db1d46b167287020227bf695b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4012019.exe
Filesize
11KB

MD5
dc60801fd9e0ca4edcaf57ae68675c31

SHA1
5ad54ba5d8d424a27da7579f3853f5d60a7fcbe3

SHA256
7a3e60dbec28e18927d13cbee7784b016d9bdc162a7f25f6f27d19ac466ff05e

SHA512
46d8016f01195a6c63ecca7eb92c0d3ed9c06fb57f2411686b7b56def9ae3624789cb9881b47017160439370a86d4c16841ca57744f8fd3e6202e78c258e67f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4012019.exe
Filesize
11KB

MD5
dc60801fd9e0ca4edcaf57ae68675c31

SHA1
5ad54ba5d8d424a27da7579f3853f5d60a7fcbe3

SHA256
7a3e60dbec28e18927d13cbee7784b016d9bdc162a7f25f6f27d19ac466ff05e

SHA512
46d8016f01195a6c63ecca7eb92c0d3ed9c06fb57f2411686b7b56def9ae3624789cb9881b47017160439370a86d4c16841ca57744f8fd3e6202e78c258e67f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5184495.exe
Filesize
172KB

MD5
f4f7f0244f7044232c558f1f0b90bb62

SHA1
ebbe23753f3c661a924c05c6dcab37e486803f93

SHA256
73a648d8c6c2af163c8f2f6aa4286959be20b1abd94ab17ca82d78c0970b5f2a

SHA512
2029d8a700e41d7771d675033b1ce151ab1a44f69de54b815d00306d55a1ef8513746f179915e7ddd6c780c4076d4b22dfd6bad34a3f784b56fccbe5d11ce284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5184495.exe
Filesize
172KB

MD5
f4f7f0244f7044232c558f1f0b90bb62

SHA1
ebbe23753f3c661a924c05c6dcab37e486803f93

SHA256
73a648d8c6c2af163c8f2f6aa4286959be20b1abd94ab17ca82d78c0970b5f2a

SHA512
2029d8a700e41d7771d675033b1ce151ab1a44f69de54b815d00306d55a1ef8513746f179915e7ddd6c780c4076d4b22dfd6bad34a3f784b56fccbe5d11ce284

Download Submit
memory/216-159-0x0000000000AD0000-0x0000000000B00000-memory.dmp

Filesize
192KB

Download
memory/216-160-0x000000000AF80000-0x000000000B598000-memory.dmp

Filesize
6.1MB

Download
memory/216-161-0x000000000AA70000-0x000000000AB7A000-memory.dmp

Filesize
1.0MB

Download
memory/216-162-0x000000000A990000-0x000000000A9A2000-memory.dmp

Filesize
72KB

Download
memory/216-163-0x000000000A9F0000-0x000000000AA2C000-memory.dmp

Filesize
240KB

Download
memory/216-164-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/216-165-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/1160-154-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads