redline | bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061

General

Target

bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe
Size

584KB
MD5

50d4f953915a8905644fff33f3c5d93d
SHA1

293b4f1218cc602258bbfe4a31b26134e2030619
SHA256

bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061
SHA512

7034becfdcae0d1d635f329c84f3c8cc2ecfff09a46ce1fbc4b155fa8b06418a36ab9a1ba22ccb3ef3f83a8b5903ea237f7a7a61d64c7f3344425a4f935a8642
SSDEEP

12288:gMrOy90SQldGhVwqYRwArrB9ZFjQ8P2FouPTyRRIhrtP8qhHspQo:+yeldQXHq9dju+HI/Xyao

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8597523.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k8597523.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8597523.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8597523.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8597523.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8597523.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4100	y9314079.exe
2600	y6890016.exe
4560	k8597523.exe
4680	l5452727.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8597523.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9314079.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9314079.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6890016.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6890016.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	k8597523.exe
4560	k8597523.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	k8597523.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4100	4796	bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe	81
PID 4796 wrote to memory of 4100	4796	bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe	81
PID 4796 wrote to memory of 4100	4796	bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe	81
PID 4100 wrote to memory of 2600	4100	y9314079.exe	82
PID 4100 wrote to memory of 2600	4100	y9314079.exe	82
PID 4100 wrote to memory of 2600	4100	y9314079.exe	82
PID 2600 wrote to memory of 4560	2600	y6890016.exe	83
PID 2600 wrote to memory of 4560	2600	y6890016.exe	83
PID 2600 wrote to memory of 4680	2600	y6890016.exe	84
PID 2600 wrote to memory of 4680	2600	y6890016.exe	84
PID 2600 wrote to memory of 4680	2600	y6890016.exe	84

C:\Users\Admin\AppData\Local\Temp\bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe
"C:\Users\Admin\AppData\Local\Temp\bf60735c103200ff92353a4109190972b95a0be61b66c7b8ba45037e978e7061.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9314079.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9314079.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6890016.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6890016.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8597523.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8597523.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5452727.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5452727.exe
      4⤵
      Executes dropped EXE
      PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9314079.exe

Filesize
377KB

MD5
d9e5f5dcd39a0837ac1aed97d0773a78

SHA1
04ebab6ae1b267673e5b8305a674be7b5067d9df

SHA256
6dffcb967d2f82e5edf4cde894cd992ccda92e8f3ff46872cf6fd360cbc35cc7

SHA512
834ccf3aba485892530dc489c9b08324f22bf427e8f27eb88f377232699a43f230cd2e3bc22dc98789e821df59f1745be61cff08696b5bd0f11c86b3abdb37c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9314079.exe

Filesize
377KB

MD5
d9e5f5dcd39a0837ac1aed97d0773a78

SHA1
04ebab6ae1b267673e5b8305a674be7b5067d9df

SHA256
6dffcb967d2f82e5edf4cde894cd992ccda92e8f3ff46872cf6fd360cbc35cc7

SHA512
834ccf3aba485892530dc489c9b08324f22bf427e8f27eb88f377232699a43f230cd2e3bc22dc98789e821df59f1745be61cff08696b5bd0f11c86b3abdb37c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6890016.exe

Filesize
206KB

MD5
561dda1ee26f37df77aec08db7a90424

SHA1
13da72393f5d9f7af609ad8a06c8b28e68e905fd

SHA256
d24a9cffabb7447f755ccd4a667bb8d4cd0f95cd216e1dcad0f3eb33a9315ae1

SHA512
989f3e73e6233acd9c9e829bdb9f7d11fc1737752801b52f5aa01fe9169a02ee2788a7fc7f4a3c26e604f2c3a7e4531919566da03eec236f954e8caa126a8297

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6890016.exe

Filesize
206KB

MD5
561dda1ee26f37df77aec08db7a90424

SHA1
13da72393f5d9f7af609ad8a06c8b28e68e905fd

SHA256
d24a9cffabb7447f755ccd4a667bb8d4cd0f95cd216e1dcad0f3eb33a9315ae1

SHA512
989f3e73e6233acd9c9e829bdb9f7d11fc1737752801b52f5aa01fe9169a02ee2788a7fc7f4a3c26e604f2c3a7e4531919566da03eec236f954e8caa126a8297

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8597523.exe

Filesize
13KB

MD5
e0eb0a22b5029993751042ed80b22e06

SHA1
78cd2c8be1132cd38c931e443f721ad441e63445

SHA256
9f4206ad23be61cc5c24208110b08ccec3e4f8c312860e9ae01add021b3dc369

SHA512
e1fb5d8dcbfa63530b4b339fe2a73756a5924dee642c772a0003f171cd71f7d96f663da4394c0e98bebe48bfa361496596f781ebbfc74c529d41375db6e6290a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8597523.exe

Filesize
13KB

MD5
e0eb0a22b5029993751042ed80b22e06

SHA1
78cd2c8be1132cd38c931e443f721ad441e63445

SHA256
9f4206ad23be61cc5c24208110b08ccec3e4f8c312860e9ae01add021b3dc369

SHA512
e1fb5d8dcbfa63530b4b339fe2a73756a5924dee642c772a0003f171cd71f7d96f663da4394c0e98bebe48bfa361496596f781ebbfc74c529d41375db6e6290a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5452727.exe

Filesize
172KB

MD5
f3d0b94a5db7ddbcf4f4b00a1ed8b464

SHA1
e2b7b5337ac6f9aa16364b67df70629e63fa836c

SHA256
6e37d2cdd8855300a59f98be9a862a3bd42be5c47fb44b5bb029e8869cf8f12f

SHA512
30b4da8a0f1090856136d79f7236bd561b5f5ba5aa9ed6401db2919cd68f86f339fc242d61f68075c72c58310a2b3081575d58c527284e8049bdea6665fe756f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5452727.exe

Filesize
172KB

MD5
f3d0b94a5db7ddbcf4f4b00a1ed8b464

SHA1
e2b7b5337ac6f9aa16364b67df70629e63fa836c

SHA256
6e37d2cdd8855300a59f98be9a862a3bd42be5c47fb44b5bb029e8869cf8f12f

SHA512
30b4da8a0f1090856136d79f7236bd561b5f5ba5aa9ed6401db2919cd68f86f339fc242d61f68075c72c58310a2b3081575d58c527284e8049bdea6665fe756f

Download Submit
memory/4560-154-0x0000000000B20000-0x0000000000B2A000-memory.dmp

Filesize
40KB

Download
memory/4680-159-0x0000000000AF0000-0x0000000000B20000-memory.dmp

Filesize
192KB

Download
memory/4680-160-0x000000000AFC0000-0x000000000B5D8000-memory.dmp

Filesize
6.1MB

Download
memory/4680-161-0x000000000AAB0000-0x000000000ABBA000-memory.dmp

Filesize
1.0MB

Download
memory/4680-162-0x000000000A9C0000-0x000000000A9D2000-memory.dmp

Filesize
72KB

Download
memory/4680-163-0x000000000AA20000-0x000000000AA5C000-memory.dmp

Filesize
240KB

Download
memory/4680-164-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4680-165-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads