redline | 68e0e4ed7e8ba7926250e591b59bd656afee9a1c686e920b1171e95ef5117e49

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81129bc3f6d0bf85583cb730fcf44d7b.exe
Size 583KB
Sample230606-cp52lsbf72
SHA256 68e0e4ed7e8ba7926250e591b59bd656afee9a1c686e920b1171e95ef5117e49
MD5 81129bc3f6d0bf85583cb730fcf44d7b
SHA1 a74888be0cdd868558dab8beacc25f837b5ef5e6
SHA512 214a3eb2dc2e8b91dd66cec4915cf381213b6bc983c95c4281fe98b9abd9d29caddae3ce534eb515df428584dab3bee8e03b3427a4200c397a9508fbef61da87
SSDEEP 12288:nMrQTy90kACCn0svHPiLxOU+Un/fRmzH2rkeCC44Y5T8:dTyyHHUxOm/fR6H2r/e4Y5g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0242549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0242549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0242549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0242549.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k0242549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0242549.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2304	y7822802.exe
832	y9800088.exe
1776	k0242549.exe
4504	l1562857.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0242549.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	81129bc3f6d0bf85583cb730fcf44d7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81129bc3f6d0bf85583cb730fcf44d7b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7822802.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7822802.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9800088.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9800088.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	k0242549.exe
1776	k0242549.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	k0242549.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2304	2272	81129bc3f6d0bf85583cb730fcf44d7b.exe	78
PID 2272 wrote to memory of 2304	2272	81129bc3f6d0bf85583cb730fcf44d7b.exe	78
PID 2272 wrote to memory of 2304	2272	81129bc3f6d0bf85583cb730fcf44d7b.exe	78
PID 2304 wrote to memory of 832	2304	y7822802.exe	79
PID 2304 wrote to memory of 832	2304	y7822802.exe	79
PID 2304 wrote to memory of 832	2304	y7822802.exe	79
PID 832 wrote to memory of 1776	832	y9800088.exe	80
PID 832 wrote to memory of 1776	832	y9800088.exe	80
PID 832 wrote to memory of 4504	832	y9800088.exe	82
PID 832 wrote to memory of 4504	832	y9800088.exe	82
PID 832 wrote to memory of 4504	832	y9800088.exe	82

C:\Users\Admin\AppData\Local\Temp\81129bc3f6d0bf85583cb730fcf44d7b.exe
"C:\Users\Admin\AppData\Local\Temp\81129bc3f6d0bf85583cb730fcf44d7b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7822802.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7822802.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9800088.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9800088.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0242549.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0242549.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1562857.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1562857.exe
      4⤵
      Executes dropped EXE
      PID:4504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y7822802.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7822802.exe
Size 377KB
SHA256 375182660cce780b33aea89de4366f2bbb840424af1022d569b8aee1be7eeb0a
MD5 94354a895c989d8f59f4d05ca885c849
SHA1 617dd693dc80d52530e74cae416f348609cb2ba4
SHA512 c062ff57bb98ef23a9cab922fc7bdaafc94eafff5ca6abc9af486d351460464d6dbdaf22aabec1958003997f51c3100301c62d55afdbf31c4df7f0d1622e172f
SSDEEP 6144:Kky+bnr+Sp0yN90QE1B3Y1mevPZmY8O1aLxQUTEh3OJmQ8AqURmvHxSKrjLk:kMrSy905stsYV1aLxQU+OJ/bRmvHTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7822802.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7822802.exe
Size 377KB
SHA256 375182660cce780b33aea89de4366f2bbb840424af1022d569b8aee1be7eeb0a
MD5 94354a895c989d8f59f4d05ca885c849
SHA1 617dd693dc80d52530e74cae416f348609cb2ba4
SHA512 c062ff57bb98ef23a9cab922fc7bdaafc94eafff5ca6abc9af486d351460464d6dbdaf22aabec1958003997f51c3100301c62d55afdbf31c4df7f0d1622e172f
SSDEEP 6144:Kky+bnr+Sp0yN90QE1B3Y1mevPZmY8O1aLxQUTEh3OJmQ8AqURmvHxSKrjLk:kMrSy905stsYV1aLxQU+OJ/bRmvHTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

y9800088.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9800088.exe
Size 206KB
SHA256 13e8476975404af8b3c5e9cc1194311305728d1d664965b73b957e3ad186ad30
MD5 a8529dc880bbf91c6c8de4ddb98d30f1
SHA1 d5b27fdde4cb974c07469e5b8e2f947472ba1825
SHA512 cd3f24e8e0e8e5e0ea4b565bf043865bcbdf03dd95053fbcc459ec557724751bc2de3fb514e7b7271c64746f0c4415cfeb7e3248a1c734c0292297932a70f257
SSDEEP 6144:Kcy+bnr+Sp0yN90QEI2x+EjK2UimZa3ZA:kMr+y90aw22MZ0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

y9800088.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9800088.exe
Size 206KB
SHA256 13e8476975404af8b3c5e9cc1194311305728d1d664965b73b957e3ad186ad30
MD5 a8529dc880bbf91c6c8de4ddb98d30f1
SHA1 d5b27fdde4cb974c07469e5b8e2f947472ba1825
SHA512 cd3f24e8e0e8e5e0ea4b565bf043865bcbdf03dd95053fbcc459ec557724751bc2de3fb514e7b7271c64746f0c4415cfeb7e3248a1c734c0292297932a70f257
SSDEEP 6144:Kcy+bnr+Sp0yN90QEI2x+EjK2UimZa3ZA:kMr+y90aw22MZ0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0242549.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0242549.exe
Size 12KB
SHA256 d4e1e013692be1ca4a62f979de2586175d5183bc03e903f7ee95ede1959a95bd
MD5 ddfb86c57c74804dc1bf9680dce67261
SHA1 204605fbdb68a336f1692d918b6fe1dc693e66e3
SHA512 6ee86d0811945b73f6c8289b02333a95bd609c4c70ab76038746faee91dc442490698f9cbf4d9508b6a8521c0300117f316ecf0c1f797e9b77e077e57664093b
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0242549.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0242549.exe
Size 12KB
SHA256 d4e1e013692be1ca4a62f979de2586175d5183bc03e903f7ee95ede1959a95bd
MD5 ddfb86c57c74804dc1bf9680dce67261
SHA1 204605fbdb68a336f1692d918b6fe1dc693e66e3
SHA512 6ee86d0811945b73f6c8289b02333a95bd609c4c70ab76038746faee91dc442490698f9cbf4d9508b6a8521c0300117f316ecf0c1f797e9b77e077e57664093b
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1562857.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1562857.exe
Size 172KB
SHA256 46895c69658e91896711975fed25f9f48e4151fd02d744dcdc40e6377d598ffd
MD5 fcea17f3fc9b24623c4216c98ae5aaab
SHA1 c47cae6c3ec33925f521dcc85c5a81acf432967d
SHA512 ee40f974ab4e25547b98fe2cbeb1665c04ca1cbaee98232e8c2e5c03045cb34f05f950fb8c0aad6dfa4a3ba5490d70025e9198d3779d54296da820d00c421aa7
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1562857.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1562857.exe
Size 172KB
SHA256 46895c69658e91896711975fed25f9f48e4151fd02d744dcdc40e6377d598ffd
MD5 fcea17f3fc9b24623c4216c98ae5aaab
SHA1 c47cae6c3ec33925f521dcc85c5a81acf432967d
SHA512 ee40f974ab4e25547b98fe2cbeb1665c04ca1cbaee98232e8c2e5c03045cb34f05f950fb8c0aad6dfa4a3ba5490d70025e9198d3779d54296da820d00c421aa7
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1776-154-0x0000000000560000-0x000000000056A000-memory.dmp

Download

memory/4504-159-0x00000000006D0000-0x0000000000700000-memory.dmp

Download

memory/4504-160-0x000000000AB80000-0x000000000B198000-memory.dmp

Download

memory/4504-161-0x000000000A670000-0x000000000A77A000-memory.dmp

Download

memory/4504-162-0x000000000A590000-0x000000000A5A2000-memory.dmp

Download

memory/4504-163-0x000000000A5F0000-0x000000000A62C000-memory.dmp

Download

memory/4504-164-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/4504-165-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download