redline | b3d95c95d03dca71007e104cf69f9cb60988f9645f7690600b0d530fed57aa1e

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78acac8185e2047d03adca753bac2121.exe
Size 584KB
Sample230606-cp52lsbf74
SHA256 b3d95c95d03dca71007e104cf69f9cb60988f9645f7690600b0d530fed57aa1e
MD5 78acac8185e2047d03adca753bac2121
SHA1 5d77ae6c22626aecb4fee7d222f0371735d96373
SHA512 7d44a777e722559a70f93158709641190ee8642dae9c2c79101c58ab83d5f1b953f817e07d52d6e973286fe8a644756b3b0f81f443af74b93894dd3251289097
SSDEEP 12288:9Mr+y90/b4VK+z/FnUN86QDDnheKH915tof9HEy8C7U56hK:3yOs8+jFUNxWsKT5uf9HR7UIc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0291595.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k0291595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0291595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0291595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0291595.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0291595.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1692	y7387130.exe
4248	y4706728.exe
3244	k0291595.exe
2676	l7887305.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0291595.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	78acac8185e2047d03adca753bac2121.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	78acac8185e2047d03adca753bac2121.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7387130.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7387130.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4706728.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4706728.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3244	k0291595.exe
3244	k0291595.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	k0291595.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1692	3756	78acac8185e2047d03adca753bac2121.exe	84
PID 3756 wrote to memory of 1692	3756	78acac8185e2047d03adca753bac2121.exe	84
PID 3756 wrote to memory of 1692	3756	78acac8185e2047d03adca753bac2121.exe	84
PID 1692 wrote to memory of 4248	1692	y7387130.exe	85
PID 1692 wrote to memory of 4248	1692	y7387130.exe	85
PID 1692 wrote to memory of 4248	1692	y7387130.exe	85
PID 4248 wrote to memory of 3244	4248	y4706728.exe	86
PID 4248 wrote to memory of 3244	4248	y4706728.exe	86
PID 4248 wrote to memory of 2676	4248	y4706728.exe	87
PID 4248 wrote to memory of 2676	4248	y4706728.exe	87
PID 4248 wrote to memory of 2676	4248	y4706728.exe	87

C:\Users\Admin\AppData\Local\Temp\78acac8185e2047d03adca753bac2121.exe
"C:\Users\Admin\AppData\Local\Temp\78acac8185e2047d03adca753bac2121.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7387130.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7387130.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4706728.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4706728.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0291595.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0291595.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7887305.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7887305.exe
      4⤵
      Executes dropped EXE
      PID:2676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y7387130.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7387130.exe
Size 377KB
SHA256 b22f33973e8f395a1dfdc56b387746c03572010b9ff7a9452cf4324647cc099f
MD5 08d23afa18ba4ed63fac191d07e72877
SHA1 29c7c369306af55456ac06cc67013c26062e4524
SHA512 aecc1355bd04344a3a228c2131318c23ff0025c01322bf60b7c044c0396e4cf873ebdf0575a5dcb882071f7f0cf3c258187fde40d3a248087ab0c0286e280d7c
SSDEEP 6144:Key+bnr+Op0yN90QENOhHC1kUNlah5MPgEVWnheKl92kKx1jSw7PsoALQse9OREK:aMrWy90nOhHskUNlpDWnheKLQ15EoA95
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7387130.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7387130.exe
Size 377KB
SHA256 b22f33973e8f395a1dfdc56b387746c03572010b9ff7a9452cf4324647cc099f
MD5 08d23afa18ba4ed63fac191d07e72877
SHA1 29c7c369306af55456ac06cc67013c26062e4524
SHA512 aecc1355bd04344a3a228c2131318c23ff0025c01322bf60b7c044c0396e4cf873ebdf0575a5dcb882071f7f0cf3c258187fde40d3a248087ab0c0286e280d7c
SSDEEP 6144:Key+bnr+Op0yN90QENOhHC1kUNlah5MPgEVWnheKl92kKx1jSw7PsoALQse9OREK:aMrWy90nOhHskUNlpDWnheKLQ15EoA95
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4706728.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4706728.exe
Size 206KB
SHA256 de49256769b28bb0d7512ffc2d850e779b532b97112cbf81781fb268c918bd6f
MD5 d57c693eeb2f709a0740121d449e24d9
SHA1 25f1e0c4c59b959dd91fd281c4a416c7669d079b
SHA512 fd55db01b8feb2d8c05794fed24e0f6cf794fe231627a1e6f437509ba113d722fca08572f14d57e98ecc26de1361baf701aa18f76e6deb88dbbe001dcc24fd19
SSDEEP 6144:Kxy+bnr+6p0yN90QEeEMwvFptELqcx7Ny:LMruy90UETxyqcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4706728.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4706728.exe
Size 206KB
SHA256 de49256769b28bb0d7512ffc2d850e779b532b97112cbf81781fb268c918bd6f
MD5 d57c693eeb2f709a0740121d449e24d9
SHA1 25f1e0c4c59b959dd91fd281c4a416c7669d079b
SHA512 fd55db01b8feb2d8c05794fed24e0f6cf794fe231627a1e6f437509ba113d722fca08572f14d57e98ecc26de1361baf701aa18f76e6deb88dbbe001dcc24fd19
SSDEEP 6144:Kxy+bnr+6p0yN90QEeEMwvFptELqcx7Ny:LMruy90UETxyqcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0291595.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0291595.exe
Size 12KB
SHA256 c115c3591ede70ce9c3b5c72899feb482792d1dcdd27a0fa54e8f47095bad4f6
MD5 93a93e15d604694be8eb4aba4d4d65e8
SHA1 d5b31d1982d275f31eed8a82b4e8d8e97f056a7a
SHA512 80077730adf4a74e1fe4bd2958b66095e59463af16f9e7d7b2e4a12ee0777674e82b5b4696fea710613b303a156195fb1d4fb8d120e37213e502947ca8a41d49
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0291595.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0291595.exe
Size 12KB
SHA256 c115c3591ede70ce9c3b5c72899feb482792d1dcdd27a0fa54e8f47095bad4f6
MD5 93a93e15d604694be8eb4aba4d4d65e8
SHA1 d5b31d1982d275f31eed8a82b4e8d8e97f056a7a
SHA512 80077730adf4a74e1fe4bd2958b66095e59463af16f9e7d7b2e4a12ee0777674e82b5b4696fea710613b303a156195fb1d4fb8d120e37213e502947ca8a41d49
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l7887305.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7887305.exe
Size 172KB
SHA256 976db9c773c0a8a9caaf42e30f086d1a6e6f4e1ab2752d7e561c4bba985aceb0
MD5 6bbe41983dc371cb6f19fd5475bf7a50
SHA1 7baeeae641cd22ae6476e38b095259e7013fb77d
SHA512 79fe607ef2ff055bf9ab3ca5058c1bd68ee91dbfb8e410365dd927abeffb65a4c9cb81e642b8482fe6b6c08949063eadcde34c9cfe930811dac26573210a489c
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l7887305.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7887305.exe
Size 172KB
SHA256 976db9c773c0a8a9caaf42e30f086d1a6e6f4e1ab2752d7e561c4bba985aceb0
MD5 6bbe41983dc371cb6f19fd5475bf7a50
SHA1 7baeeae641cd22ae6476e38b095259e7013fb77d
SHA512 79fe607ef2ff055bf9ab3ca5058c1bd68ee91dbfb8e410365dd927abeffb65a4c9cb81e642b8482fe6b6c08949063eadcde34c9cfe930811dac26573210a489c
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2676-159-0x0000000000740000-0x0000000000770000-memory.dmp

Download

memory/2676-160-0x000000000AB40000-0x000000000B158000-memory.dmp

Download

memory/2676-161-0x000000000A6C0000-0x000000000A7CA000-memory.dmp

Download

memory/2676-162-0x000000000A600000-0x000000000A612000-memory.dmp

Download

memory/2676-163-0x000000000A660000-0x000000000A69C000-memory.dmp

Download

memory/2676-164-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/2676-165-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/3244-154-0x00000000008F0000-0x00000000008FA000-memory.dmp

Download