redline | 7708921fd4e02474a5e5a2f74d1c7f6108adea125fb049c45f60ae83c67d8bc7

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5de9648dab34a9e31c77be8ca728418.exe
Size 857KB
Sample230606-cszzrsbf95
SHA256 7708921fd4e02474a5e5a2f74d1c7f6108adea125fb049c45f60ae83c67d8bc7
MD5 e5de9648dab34a9e31c77be8ca728418
SHA1 0ab432876ba9c347ee5c95d6f777a5d6baf82b85
SHA512 061251786bd7c91a6c55199bb7b6d99b6d87acb4000d14f4f7d440a31874244b82adc58c526bffc22d6c01e908512847a113c2f15fcc88941c9778115dbe01cd
SSDEEP 24576:by5Ha4AyNqsckDc/YMocNevHnwOBwslcFyj:O5FAIqEDWYhYeBwG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lupa evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lupa

83.97.73.126:19048

Attributes

auth_value
6a764aa41830c77712442516d143bc9c

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o0783044.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o0783044.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	o0783044.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o0783044.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o0783044.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o0783044.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4624	z4927826.exe
2428	z8284669.exe
1472	o0783044.exe
3476	p5068169.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	o0783044.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8284669.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8284669.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e5de9648dab34a9e31c77be8ca728418.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e5de9648dab34a9e31c77be8ca728418.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z4927826.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4927826.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	o0783044.exe
1472	o0783044.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	o0783044.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4624	3772	e5de9648dab34a9e31c77be8ca728418.exe	86
PID 3772 wrote to memory of 4624	3772	e5de9648dab34a9e31c77be8ca728418.exe	86
PID 3772 wrote to memory of 4624	3772	e5de9648dab34a9e31c77be8ca728418.exe	86
PID 4624 wrote to memory of 2428	4624	z4927826.exe	87
PID 4624 wrote to memory of 2428	4624	z4927826.exe	87
PID 4624 wrote to memory of 2428	4624	z4927826.exe	87
PID 2428 wrote to memory of 1472	2428	z8284669.exe	88
PID 2428 wrote to memory of 1472	2428	z8284669.exe	88
PID 2428 wrote to memory of 3476	2428	z8284669.exe	91
PID 2428 wrote to memory of 3476	2428	z8284669.exe	91
PID 2428 wrote to memory of 3476	2428	z8284669.exe	91

C:\Users\Admin\AppData\Local\Temp\e5de9648dab34a9e31c77be8ca728418.exe
"C:\Users\Admin\AppData\Local\Temp\e5de9648dab34a9e31c77be8ca728418.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4927826.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4927826.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8284669.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8284669.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0783044.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0783044.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5068169.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5068169.exe
      4⤵
      Executes dropped EXE
      PID:3476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z4927826.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4927826.exe
Size 411KB
SHA256 0c3a637154dcf9c86528a43572825aea53fa2bcb179292a597da640ab676b40f
MD5 7f541f3e75deca1cb087d1757d3ec85d
SHA1 db9753847ec91f9724fe7889c61bd3959bc60c96
SHA512 21f49746a4dba8a198732c2e50fe084c15ad1ba037c95e09072b589a2323ad7a59203fa6fa423369eeec30dbfd957a36b76bdc8eeeb2d84318a00294f03b5b22
SSDEEP 6144:Kwy+bnr+7p0yN90QEQapYKpZRdsHMF1R3SCuRGLQGeVUDnTs+n2VArF5UGzqDSq:EMrjy90y6vRdnR3SbscPUDnThFiHDSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4927826.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4927826.exe
Size 411KB
SHA256 0c3a637154dcf9c86528a43572825aea53fa2bcb179292a597da640ab676b40f
MD5 7f541f3e75deca1cb087d1757d3ec85d
SHA1 db9753847ec91f9724fe7889c61bd3959bc60c96
SHA512 21f49746a4dba8a198732c2e50fe084c15ad1ba037c95e09072b589a2323ad7a59203fa6fa423369eeec30dbfd957a36b76bdc8eeeb2d84318a00294f03b5b22
SSDEEP 6144:Kwy+bnr+7p0yN90QEQapYKpZRdsHMF1R3SCuRGLQGeVUDnTs+n2VArF5UGzqDSq:EMrjy90y6vRdnR3SbscPUDnThFiHDSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8284669.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8284669.exe
Size 206KB
SHA256 311cdeeb531dea43e77a4888f6cc0b2f52325098efd7ec4f82da163dee7fa9c9
MD5 6100dda9229235fcc1c1490243056ead
SHA1 09dc601c580de9d07cb7ad6334b53b1310edd0e0
SHA512 9fc7ff8381d19b577c8d241c738bd6356458df7ad875ec55b1c9f295a2390c493fa7afddab7ac8470d9d7b4c63bca2eb2f79a68c50f10e586e475e1721e2d0a2
SSDEEP 3072:KUy+bnr+O1C5GWp1icKAArDZz4N9GhbkrNEk1tBfV95YsG8GJZ8EQ/o2:KUy+bnr+tp0yN90QEe8sfsZ8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8284669.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8284669.exe
Size 206KB
SHA256 311cdeeb531dea43e77a4888f6cc0b2f52325098efd7ec4f82da163dee7fa9c9
MD5 6100dda9229235fcc1c1490243056ead
SHA1 09dc601c580de9d07cb7ad6334b53b1310edd0e0
SHA512 9fc7ff8381d19b577c8d241c738bd6356458df7ad875ec55b1c9f295a2390c493fa7afddab7ac8470d9d7b4c63bca2eb2f79a68c50f10e586e475e1721e2d0a2
SSDEEP 3072:KUy+bnr+O1C5GWp1icKAArDZz4N9GhbkrNEk1tBfV95YsG8GJZ8EQ/o2:KUy+bnr+tp0yN90QEe8sfsZ8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

o0783044.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0783044.exe
Size 12KB
SHA256 ddc9cfc68654e4b505c0dfbd8bfe64c35d72a3de4b0b285dd65d6d3654045620
MD5 275fddc918e4b44181538ba2ec1ea8c3
SHA1 7e37bacc13c1f84e56011e727944f759f908948d
SHA512 ccb661c8ea00d1eaaf3f3fa2fd86c44cf5fc3877a676d5fb771cc4c6ab8a4d6a1e6f0430d7e635f0fca6cb0d0fd5080c5cfe91a8ac99a8b3efca8c132ea41cf7
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

o0783044.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o0783044.exe
Size 12KB
SHA256 ddc9cfc68654e4b505c0dfbd8bfe64c35d72a3de4b0b285dd65d6d3654045620
MD5 275fddc918e4b44181538ba2ec1ea8c3
SHA1 7e37bacc13c1f84e56011e727944f759f908948d
SHA512 ccb661c8ea00d1eaaf3f3fa2fd86c44cf5fc3877a676d5fb771cc4c6ab8a4d6a1e6f0430d7e635f0fca6cb0d0fd5080c5cfe91a8ac99a8b3efca8c132ea41cf7
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

p5068169.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5068169.exe
Size 172KB
SHA256 69f3d8b91467a3a1c3798b8f99cf24595a5b7798ee03324e6ca1d5dd97f62aab
MD5 88163faeb98607584a2b5013b23fc949
SHA1 68e80f91d21859a36c6f1704049a9b92030112f9
SHA512 546596293fc200cc9b651928ff41d1b497257366250db950d05f8358461a385cb4abb73af2883a78f1ee2080e07b726d832d4e675a9d7babada33bd7b41bb542
SSDEEP 3072:OPgUSkUOr8T/nMxN1UpgBbH1dP1Aj8e8hA:YnqameH1dP1Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

p5068169.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5068169.exe
Size 172KB
SHA256 69f3d8b91467a3a1c3798b8f99cf24595a5b7798ee03324e6ca1d5dd97f62aab
MD5 88163faeb98607584a2b5013b23fc949
SHA1 68e80f91d21859a36c6f1704049a9b92030112f9
SHA512 546596293fc200cc9b651928ff41d1b497257366250db950d05f8358461a385cb4abb73af2883a78f1ee2080e07b726d832d4e675a9d7babada33bd7b41bb542
SSDEEP 3072:OPgUSkUOr8T/nMxN1UpgBbH1dP1Aj8e8hA:YnqameH1dP1Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1472-154-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Download

memory/3476-159-0x00000000007A0000-0x00000000007D0000-memory.dmp

Download

memory/3476-160-0x000000000ACD0000-0x000000000B2E8000-memory.dmp

Download

memory/3476-161-0x000000000A7C0000-0x000000000A8CA000-memory.dmp

Download

memory/3476-162-0x00000000051D0000-0x00000000051E2000-memory.dmp

Download

memory/3476-163-0x000000000A6F0000-0x000000000A72C000-memory.dmp

Download

memory/3476-164-0x0000000005220000-0x0000000005230000-memory.dmp

Download

memory/3476-165-0x0000000005220000-0x0000000005230000-memory.dmp

Download