redline | a831f4abfb429b97536aa52605d5e7405007ea5b2af185e6dcee9234c21804cc

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7bf75dc5395e5623f80df6f9080632e.exe
Size

736KB
MD5

c7bf75dc5395e5623f80df6f9080632e
SHA1

a376dabda615aed4258a5c88e5360b84b71271fe
SHA256

a831f4abfb429b97536aa52605d5e7405007ea5b2af185e6dcee9234c21804cc
SHA512

d3ad36a5085d8fc55f406790fbf28b2d477d2ee6e759875e90c0a054e457050e65dd8b7ece21d5fdfdde05de876727c6c249c5d4c79d223b2aaec5b302330871
SSDEEP

12288:VMrKy90GXkxlINahTNCrvxyekItxPZ2sxMKyhH/sq0snucYgpp//NcdG:TyP0vYauvxDkIJ2sxM7hU/cYgj/NOG

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a3611066.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3611066.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3611066.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3611066.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3611066.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3611066.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3611066.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v2255143.exev2049348.exev0097665.exea3611066.exeb4949158.exec4591357.exe

pid process

1856 v2255143.exe
1392 v2049348.exe
2172 v0097665.exe
2112 a3611066.exe
3428 b4949158.exe
332 c4591357.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a3611066.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3611066.exe

pid	process
1856	v2255143.exe
1392	v2049348.exe
2172	v0097665.exe
2112	a3611066.exe
3428	b4949158.exe
332	c4591357.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3611066.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v0097665.exec7bf75dc5395e5623f80df6f9080632e.exev2255143.exev2049348.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0097665.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v0097665.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c7bf75dc5395e5623f80df6f9080632e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c7bf75dc5395e5623f80df6f9080632e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2255143.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2255143.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2049348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2049348.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4949158.exe

description pid process target process

PID 3428 set thread context of 2020 3428 b4949158.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1348 3428 WerFault.exe b4949158.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a3611066.exeAppLaunch.exe

pid process

2112 a3611066.exe
2112 a3611066.exe
2020 AppLaunch.exe
2020 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3611066.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 2112 a3611066.exe
Token: SeDebugPrivilege 2020 AppLaunch.exe

description	pid	process	target process
PID 3428 set thread context of 2020	3428	b4949158.exe	AppLaunch.exe

pid	pid_target	process	target process
1348	3428	WerFault.exe	b4949158.exe

pid	process
2112	a3611066.exe
2112	a3611066.exe
2020	AppLaunch.exe
2020	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2112	a3611066.exe
Token: SeDebugPrivilege	2020	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

c7bf75dc5395e5623f80df6f9080632e.exev2255143.exev2049348.exev0097665.exeb4949158.exe

description	pid	process	target process
PID 2472 wrote to memory of 1856	2472	c7bf75dc5395e5623f80df6f9080632e.exe	v2255143.exe
PID 2472 wrote to memory of 1856	2472	c7bf75dc5395e5623f80df6f9080632e.exe	v2255143.exe
PID 2472 wrote to memory of 1856	2472	c7bf75dc5395e5623f80df6f9080632e.exe	v2255143.exe
PID 1856 wrote to memory of 1392	1856	v2255143.exe	v2049348.exe
PID 1856 wrote to memory of 1392	1856	v2255143.exe	v2049348.exe
PID 1856 wrote to memory of 1392	1856	v2255143.exe	v2049348.exe
PID 1392 wrote to memory of 2172	1392	v2049348.exe	v0097665.exe
PID 1392 wrote to memory of 2172	1392	v2049348.exe	v0097665.exe
PID 1392 wrote to memory of 2172	1392	v2049348.exe	v0097665.exe
PID 2172 wrote to memory of 2112	2172	v0097665.exe	a3611066.exe
PID 2172 wrote to memory of 2112	2172	v0097665.exe	a3611066.exe
PID 2172 wrote to memory of 3428	2172	v0097665.exe	b4949158.exe
PID 2172 wrote to memory of 3428	2172	v0097665.exe	b4949158.exe
PID 2172 wrote to memory of 3428	2172	v0097665.exe	b4949158.exe
PID 3428 wrote to memory of 2020	3428	b4949158.exe	AppLaunch.exe
PID 3428 wrote to memory of 2020	3428	b4949158.exe	AppLaunch.exe
PID 3428 wrote to memory of 2020	3428	b4949158.exe	AppLaunch.exe
PID 3428 wrote to memory of 2020	3428	b4949158.exe	AppLaunch.exe
PID 3428 wrote to memory of 2020	3428	b4949158.exe	AppLaunch.exe
PID 1392 wrote to memory of 332	1392	v2049348.exe	c4591357.exe
PID 1392 wrote to memory of 332	1392	v2049348.exe	c4591357.exe
PID 1392 wrote to memory of 332	1392	v2049348.exe	c4591357.exe

C:\Users\Admin\AppData\Local\Temp\c7bf75dc5395e5623f80df6f9080632e.exe
"C:\Users\Admin\AppData\Local\Temp\c7bf75dc5395e5623f80df6f9080632e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 140
6⤵
- Program crash
PID:1348

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exe
4⤵
- Executes dropped EXE
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3428 -ip 3428
1⤵
PID:3436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exe
Filesize
530KB

MD5
1e2eb71d6374d06c22ddd409dd39b92f

SHA1
526871234f41e4cc53f00b7d83d948a5b180501a

SHA256
6393b614d0f7738c1407c6d7509bcaaf881ec9aacb3751ab918ecc6ecda10c1d

SHA512
3b9a59a92d9934b0c24c30108ff4b8f338e7b63afca1a792485b16cd23281edd7073236de2e08ee3d96b633de5f00ce82f6a5d6f1bddda50f482d46cfa5f916c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2255143.exe
Filesize
530KB

MD5
1e2eb71d6374d06c22ddd409dd39b92f

SHA1
526871234f41e4cc53f00b7d83d948a5b180501a

SHA256
6393b614d0f7738c1407c6d7509bcaaf881ec9aacb3751ab918ecc6ecda10c1d

SHA512
3b9a59a92d9934b0c24c30108ff4b8f338e7b63afca1a792485b16cd23281edd7073236de2e08ee3d96b633de5f00ce82f6a5d6f1bddda50f482d46cfa5f916c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exe
Filesize
357KB

MD5
79f32459e012e74c3dcecab09feaeea6

SHA1
6f7bb377cc04cb13a0e5305b8ade3f659bb09359

SHA256
02fd420afa66b1e359ab3be8132f1fca41a2f014cdca7b72a9d7d82f193ab265

SHA512
f6eb4cb83028a6ed181b707ccca519f69d2eff94d9f8ed1556663b4c7a2ba4d854d61b30328d35aded63487453b1711a6c6ed0131fb9ea5013742f2219db8fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2049348.exe
Filesize
357KB

MD5
79f32459e012e74c3dcecab09feaeea6

SHA1
6f7bb377cc04cb13a0e5305b8ade3f659bb09359

SHA256
02fd420afa66b1e359ab3be8132f1fca41a2f014cdca7b72a9d7d82f193ab265

SHA512
f6eb4cb83028a6ed181b707ccca519f69d2eff94d9f8ed1556663b4c7a2ba4d854d61b30328d35aded63487453b1711a6c6ed0131fb9ea5013742f2219db8fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exe
Filesize
172KB

MD5
efeda15795430b76be6d0dd1cbeae546

SHA1
611e033ee0c8acb3f7be87b44c0d8c6505ba6d1f

SHA256
a0adc61062017bf465d20323d11fa8402579e29661dfac9d121464c4833c9c8a

SHA512
3f4f4c20249552b8e977beb1ca14a6928c01e8a35f077a6c140979a40ac6372151dd4ddec09e988e43eb4c062397fd7ff461caba7fcd6b5fd633e38646652f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4591357.exe
Filesize
172KB

MD5
efeda15795430b76be6d0dd1cbeae546

SHA1
611e033ee0c8acb3f7be87b44c0d8c6505ba6d1f

SHA256
a0adc61062017bf465d20323d11fa8402579e29661dfac9d121464c4833c9c8a

SHA512
3f4f4c20249552b8e977beb1ca14a6928c01e8a35f077a6c140979a40ac6372151dd4ddec09e988e43eb4c062397fd7ff461caba7fcd6b5fd633e38646652f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exe
Filesize
202KB

MD5
719d41434507304244531839da3b1d6e

SHA1
4a21d1894a07fa47b6c88f952a94864c48015d21

SHA256
64e92037bca945179a83b1315bf4074c18cd73c46e0a258587aca2693fea9645

SHA512
415293d2898c94eb9d1a5c3564c11eab89834f75e7355bbbbda0b8b90020e9779f344b4dba5ab1c5403eac38689374b39e1034403fa62bdf647265b92834db7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0097665.exe
Filesize
202KB

MD5
719d41434507304244531839da3b1d6e

SHA1
4a21d1894a07fa47b6c88f952a94864c48015d21

SHA256
64e92037bca945179a83b1315bf4074c18cd73c46e0a258587aca2693fea9645

SHA512
415293d2898c94eb9d1a5c3564c11eab89834f75e7355bbbbda0b8b90020e9779f344b4dba5ab1c5403eac38689374b39e1034403fa62bdf647265b92834db7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exe
Filesize
13KB

MD5
6f6e9a2d0b0e7c9211b1cc1cbc5faa49

SHA1
4007f95b24791bf42675b3adf299e042951ec10a

SHA256
f23be7c442a3587cb85a0795218763140cd73a3760ace1eb468c11a60b54ab58

SHA512
2bf347ad5595de26455c95a9be5992dd7657b13d8697dca58166531ead656bda097f2bb4c0c5b11b5cdd02a5fef9e62731ec0eb7fdbff78fd644556efe6f91c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3611066.exe
Filesize
13KB

MD5
6f6e9a2d0b0e7c9211b1cc1cbc5faa49

SHA1
4007f95b24791bf42675b3adf299e042951ec10a

SHA256
f23be7c442a3587cb85a0795218763140cd73a3760ace1eb468c11a60b54ab58

SHA512
2bf347ad5595de26455c95a9be5992dd7657b13d8697dca58166531ead656bda097f2bb4c0c5b11b5cdd02a5fef9e62731ec0eb7fdbff78fd644556efe6f91c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exe
Filesize
117KB

MD5
5bdb50ebe74e9f8412240374002665f6

SHA1
bb08e2e8e2693fe7a653f4f334dca58a4ec5952f

SHA256
84a19044c11539c98b809f4aa1ac71288b853e568acbb35c1b69c06fb3550e1e

SHA512
b7a8802c83f12421c75aa7f19d568a89225a6b59b4f11dc7bd6c53cf8dbc93e85fd95278615ec5fe6fd898d64789b7f94b755779c431dc411905dfea17049ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4949158.exe
Filesize
117KB

MD5
5bdb50ebe74e9f8412240374002665f6

SHA1
bb08e2e8e2693fe7a653f4f334dca58a4ec5952f

SHA256
84a19044c11539c98b809f4aa1ac71288b853e568acbb35c1b69c06fb3550e1e

SHA512
b7a8802c83f12421c75aa7f19d568a89225a6b59b4f11dc7bd6c53cf8dbc93e85fd95278615ec5fe6fd898d64789b7f94b755779c431dc411905dfea17049ef3

Download Submit
memory/332-175-0x0000000000F20000-0x0000000000F50000-memory.dmp

Filesize
192KB

Download
memory/332-176-0x0000000005E50000-0x0000000006468000-memory.dmp

Filesize
6.1MB

Download
memory/332-177-0x0000000005940000-0x0000000005A4A000-memory.dmp

Filesize
1.0MB

Download
memory/332-178-0x0000000005880000-0x0000000005892000-memory.dmp

Filesize
72KB

Download
memory/332-179-0x00000000058E0000-0x000000000591C000-memory.dmp

Filesize
240KB

Download
memory/332-180-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/332-182-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/2020-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2112-161-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download