redline | 6d1bdf221c71b527cbe1e269e2262ee2d889ccec6896d68fd02bad138f598a2d

Analysis

max time kernel
161s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
468a11b146618e46cd490852ff898d34.exe
Size 584KB
Sample230606-cp52lscc5x
SHA256 6d1bdf221c71b527cbe1e269e2262ee2d889ccec6896d68fd02bad138f598a2d
MD5 468a11b146618e46cd490852ff898d34
SHA1 b6b4eafc9434d2cd6092b9f90b8952554d553962
SHA512 2dd13d4570c43e4482cd33aa144f2698e472429c5f5608ca97e5ba6ddf35d6d183ef07a8b77720e0d9ba80364a7f6024b4f130eaa2152e7438f79b863da84cb5
SSDEEP 12288:MMrqy90MN+uFpUvsRivPrQVN7U5WOl9fuUXVOcp6EmTL:Gyr+kzRgPqNUg6uUXPkEOL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1461311.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k1461311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1461311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1461311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1461311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1461311.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4296	y6844663.exe
1996	y4414596.exe
556	k1461311.exe
116	l1909337.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1461311.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	468a11b146618e46cd490852ff898d34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	468a11b146618e46cd490852ff898d34.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6844663.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6844663.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4414596.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4414596.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	k1461311.exe
556	k1461311.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	k1461311.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4296	4528	468a11b146618e46cd490852ff898d34.exe	82
PID 4528 wrote to memory of 4296	4528	468a11b146618e46cd490852ff898d34.exe	82
PID 4528 wrote to memory of 4296	4528	468a11b146618e46cd490852ff898d34.exe	82
PID 4296 wrote to memory of 1996	4296	y6844663.exe	83
PID 4296 wrote to memory of 1996	4296	y6844663.exe	83
PID 4296 wrote to memory of 1996	4296	y6844663.exe	83
PID 1996 wrote to memory of 556	1996	y4414596.exe	84
PID 1996 wrote to memory of 556	1996	y4414596.exe	84
PID 1996 wrote to memory of 116	1996	y4414596.exe	85
PID 1996 wrote to memory of 116	1996	y4414596.exe	85
PID 1996 wrote to memory of 116	1996	y4414596.exe	85

C:\Users\Admin\AppData\Local\Temp\468a11b146618e46cd490852ff898d34.exe
"C:\Users\Admin\AppData\Local\Temp\468a11b146618e46cd490852ff898d34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6844663.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6844663.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4414596.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4414596.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1461311.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1461311.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1909337.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1909337.exe
      4⤵
      Executes dropped EXE
      PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y6844663.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6844663.exe
Size 377KB
SHA256 6f40aa97e9c931ee6d0dcc3c5289cc23aa24daa80bccf76f3f591fcd0cbb7d21
MD5 859dce6c5376c9b5d9245697e9e7be44
SHA1 be4519194aea8e50cda47ec96f1920d6d3f60b05
SHA512 ae495dd017d399360e5578e2b9286492ff2898bb6696e60cd89db527a39455339549cffea67f939a4aa28f570758cb7e204d926fbcbea3240abd35aa61f19ddd
SSDEEP 6144:Kxy+bnr+yp0yN90QEfkoFkWnrZNZ47QKVdgdggIOkAdIeeUxTW/mc+PdY/SukI5:PMrCy90552rNOa7U5W/m91ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6844663.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6844663.exe
Size 377KB
SHA256 6f40aa97e9c931ee6d0dcc3c5289cc23aa24daa80bccf76f3f591fcd0cbb7d21
MD5 859dce6c5376c9b5d9245697e9e7be44
SHA1 be4519194aea8e50cda47ec96f1920d6d3f60b05
SHA512 ae495dd017d399360e5578e2b9286492ff2898bb6696e60cd89db527a39455339549cffea67f939a4aa28f570758cb7e204d926fbcbea3240abd35aa61f19ddd
SSDEEP 6144:Kxy+bnr+yp0yN90QEfkoFkWnrZNZ47QKVdgdggIOkAdIeeUxTW/mc+PdY/SukI5:PMrCy90552rNOa7U5W/m91ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4414596.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4414596.exe
Size 206KB
SHA256 86852900e45679c4fa9ddd5819bf02acd4c1dd296a3395f1dda882e243352a97
MD5 a1233ef95cebb9748c2af8c11cfb9eab
SHA1 589306329a935a887700241a9c6df4772a0f7726
SHA512 b4562b2b6ad3530dc2014707c7037c71e7e15a61dd09f088c0333ea7bef8f86259442c8c34612c5a0fb635435df0d92a3e5cde917be9de8d7302307df497cd9e
SSDEEP 3072:Kzy+bnr+O1b5GWp1icKAArDZz4N9GhbkrNEk16PMaLy6rnJqnhVYVUFCof:Kzy+bnr+Ip0yN90QE7LyinJqnhVcUF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4414596.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4414596.exe
Size 206KB
SHA256 86852900e45679c4fa9ddd5819bf02acd4c1dd296a3395f1dda882e243352a97
MD5 a1233ef95cebb9748c2af8c11cfb9eab
SHA1 589306329a935a887700241a9c6df4772a0f7726
SHA512 b4562b2b6ad3530dc2014707c7037c71e7e15a61dd09f088c0333ea7bef8f86259442c8c34612c5a0fb635435df0d92a3e5cde917be9de8d7302307df497cd9e
SSDEEP 3072:Kzy+bnr+O1b5GWp1icKAArDZz4N9GhbkrNEk16PMaLy6rnJqnhVYVUFCof:Kzy+bnr+Ip0yN90QE7LyinJqnhVcUF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1461311.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1461311.exe
Size 12KB
SHA256 da90d38e1ffcb41ce0c67ff25152839c9e898243ce1537de76ab118b49ba3f9a
MD5 04c94ad223bab696de00a1fdfaf5e614
SHA1 9185415c103f3b46d5db57a52920603bc19db839
SHA512 be8106939d470521437fcdd9a4f2f010116748fc837fcdcd5fbdbf90999cd7b699abaa250c4019a06ea7d5de0deeeec3a90410b4b2a6b37f757a3277549a7e00
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k1461311.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1461311.exe
Size 12KB
SHA256 da90d38e1ffcb41ce0c67ff25152839c9e898243ce1537de76ab118b49ba3f9a
MD5 04c94ad223bab696de00a1fdfaf5e614
SHA1 9185415c103f3b46d5db57a52920603bc19db839
SHA512 be8106939d470521437fcdd9a4f2f010116748fc837fcdcd5fbdbf90999cd7b699abaa250c4019a06ea7d5de0deeeec3a90410b4b2a6b37f757a3277549a7e00
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1909337.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1909337.exe
Size 172KB
SHA256 98b56405565a8b823bdfb3872c4ebaae463c27826c8afb21efaecde328a8f136
MD5 f22307dc135c6d9803ea140e5524711a
SHA1 595131d77deaee3fda0a49f90eb3ab0f63792914
SHA512 73a8160f5e45142a6c7d5b6320328a60bb3439ec474ef881b01a704591f2cd37ea790cdefe81efd3a90a2cd19575ab9d47af702c9725a915f3e16f7474e2cd6a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l1909337.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1909337.exe
Size 172KB
SHA256 98b56405565a8b823bdfb3872c4ebaae463c27826c8afb21efaecde328a8f136
MD5 f22307dc135c6d9803ea140e5524711a
SHA1 595131d77deaee3fda0a49f90eb3ab0f63792914
SHA512 73a8160f5e45142a6c7d5b6320328a60bb3439ec474ef881b01a704591f2cd37ea790cdefe81efd3a90a2cd19575ab9d47af702c9725a915f3e16f7474e2cd6a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-159-0x00000000000B0000-0x00000000000E0000-memory.dmp

Download

memory/116-160-0x000000000A370000-0x000000000A988000-memory.dmp

Download

memory/116-161-0x0000000009EF0000-0x0000000009FFA000-memory.dmp

Download

memory/116-162-0x0000000009E30000-0x0000000009E42000-memory.dmp

Download

memory/116-163-0x0000000009E90000-0x0000000009ECC000-memory.dmp

Download

memory/116-164-0x0000000004880000-0x0000000004890000-memory.dmp

Download

memory/116-165-0x0000000004880000-0x0000000004890000-memory.dmp

Download

memory/556-154-0x0000000000730000-0x000000000073A000-memory.dmp

Download