redline | 5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe
Size

736KB
MD5

baad10f3b2b4ce0b7224e18f30e328a4
SHA1

1a8da4f28a7daadd186344ec2056169627eac721
SHA256

5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a
SHA512

1d9a1df9b08ec308036f844f4f74cb570cfbaad4a3255044f468b5dd73bc239400bb9ccd144adec6db5c750dd0683f3bea544f3d2abee8929c6321a671090508
SSDEEP

12288:AMrdy90UuIGtTLZnLZNjinYt+74GWrUK8ZwMYY6P4GLjfLyV:Ny+9LZFNjiY+ZTDGvLyV

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a8898709.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8898709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8898709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8898709.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8898709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8898709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8898709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v6243587.exev2681415.exev8239880.exea8898709.exeb4148499.exec8964464.exe

pid process

1944 v6243587.exe
4656 v2681415.exe
2844 v8239880.exe
4648 a8898709.exe
1992 b4148499.exe
3044 c8964464.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a8898709.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a8898709.exe

pid	process
1944	v6243587.exe
4656	v2681415.exe
2844	v8239880.exe
4648	a8898709.exe
1992	b4148499.exe
3044	c8964464.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8898709.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v6243587.exev2681415.exev8239880.exe5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6243587.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6243587.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2681415.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2681415.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v8239880.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8239880.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4148499.exe

description pid process target process

PID 1992 set thread context of 3684 1992 b4148499.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 1992 WerFault.exe b4148499.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a8898709.exeAppLaunch.exe

pid process

4648 a8898709.exe
4648 a8898709.exe
3684 AppLaunch.exe
3684 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a8898709.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 4648 a8898709.exe
Token: SeDebugPrivilege 3684 AppLaunch.exe

description	pid	process	target process
PID 1992 set thread context of 3684	1992	b4148499.exe	AppLaunch.exe

pid	pid_target	process	target process
2180	1992	WerFault.exe	b4148499.exe

pid	process
4648	a8898709.exe
4648	a8898709.exe
3684	AppLaunch.exe
3684	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4648	a8898709.exe
Token: SeDebugPrivilege	3684	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exev6243587.exev2681415.exev8239880.exeb4148499.exe

description	pid	process	target process
PID 1760 wrote to memory of 1944	1760	5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe	v6243587.exe
PID 1760 wrote to memory of 1944	1760	5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe	v6243587.exe
PID 1760 wrote to memory of 1944	1760	5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe	v6243587.exe
PID 1944 wrote to memory of 4656	1944	v6243587.exe	v2681415.exe
PID 1944 wrote to memory of 4656	1944	v6243587.exe	v2681415.exe
PID 1944 wrote to memory of 4656	1944	v6243587.exe	v2681415.exe
PID 4656 wrote to memory of 2844	4656	v2681415.exe	v8239880.exe
PID 4656 wrote to memory of 2844	4656	v2681415.exe	v8239880.exe
PID 4656 wrote to memory of 2844	4656	v2681415.exe	v8239880.exe
PID 2844 wrote to memory of 4648	2844	v8239880.exe	a8898709.exe
PID 2844 wrote to memory of 4648	2844	v8239880.exe	a8898709.exe
PID 2844 wrote to memory of 1992	2844	v8239880.exe	b4148499.exe
PID 2844 wrote to memory of 1992	2844	v8239880.exe	b4148499.exe
PID 2844 wrote to memory of 1992	2844	v8239880.exe	b4148499.exe
PID 1992 wrote to memory of 3684	1992	b4148499.exe	AppLaunch.exe
PID 1992 wrote to memory of 3684	1992	b4148499.exe	AppLaunch.exe
PID 1992 wrote to memory of 3684	1992	b4148499.exe	AppLaunch.exe
PID 1992 wrote to memory of 3684	1992	b4148499.exe	AppLaunch.exe
PID 1992 wrote to memory of 3684	1992	b4148499.exe	AppLaunch.exe
PID 4656 wrote to memory of 3044	4656	v2681415.exe	c8964464.exe
PID 4656 wrote to memory of 3044	4656	v2681415.exe	c8964464.exe
PID 4656 wrote to memory of 3044	4656	v2681415.exe	c8964464.exe

C:\Users\Admin\AppData\Local\Temp\5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe
"C:\Users\Admin\AppData\Local\Temp\5ed3ad1411adc0f83fe4eb87d5e2a59df51c6be99250dbe1590567caa6fb624a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6243587.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6243587.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2681415.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2681415.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8239880.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8239880.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8898709.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8898709.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4148499.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4148499.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 140
6⤵
- Program crash
PID:2180

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8964464.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8964464.exe
4⤵
- Executes dropped EXE
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1992 -ip 1992
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6243587.exe
Filesize
530KB

MD5
d391ff621e47d70ea98592c67eb10f15

SHA1
3a66cbe6c9bed8d8156a6db8be08408b21be603c

SHA256
344e30a82318c85c10625edfd48dcae35b54112e9423963cb3d5442904cd19dd

SHA512
29fe3d701f121305432ab4b15e549fe4dbd2cc222a8433a4e9f1a570dd8745de738117a632993f2d2f8fd009fb1b3a02afb75b3fe57c30db725f41fc46f5f90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6243587.exe
Filesize
530KB

MD5
d391ff621e47d70ea98592c67eb10f15

SHA1
3a66cbe6c9bed8d8156a6db8be08408b21be603c

SHA256
344e30a82318c85c10625edfd48dcae35b54112e9423963cb3d5442904cd19dd

SHA512
29fe3d701f121305432ab4b15e549fe4dbd2cc222a8433a4e9f1a570dd8745de738117a632993f2d2f8fd009fb1b3a02afb75b3fe57c30db725f41fc46f5f90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2681415.exe
Filesize
358KB

MD5
b9a5fe5a230f4c3a24549e4b0e49f80e

SHA1
73afa64de51800ab589483a9e01c45476910b4e1

SHA256
31d76f18f9a55dbc22c4b8506b5044beba9de4ef3f65aed7172c8a79d364341d

SHA512
722e790e23bcb47c77d263bee428c2448e67a39a140835bbc265a5fc97286025d9cda79df49e000ee56c86e87d03e607152495be162115d5a1917200ccb60465

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2681415.exe
Filesize
358KB

MD5
b9a5fe5a230f4c3a24549e4b0e49f80e

SHA1
73afa64de51800ab589483a9e01c45476910b4e1

SHA256
31d76f18f9a55dbc22c4b8506b5044beba9de4ef3f65aed7172c8a79d364341d

SHA512
722e790e23bcb47c77d263bee428c2448e67a39a140835bbc265a5fc97286025d9cda79df49e000ee56c86e87d03e607152495be162115d5a1917200ccb60465

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8964464.exe
Filesize
172KB

MD5
e201a8417dc3ba8a723cf034314747b2

SHA1
87a4a235d1f99f3cc5da67c373429a2eeddc62e4

SHA256
0e66f74658bdd9cd28ee022177b35ee00d53af8030f0e3ac9d8394af19fa40a8

SHA512
6d9c550a10f133c792430b8731e9e2d6f0c66dbb55aa48a1ba95fe46d59161f452af45f166eec1f1567590cdaf580728990cca3f1ba9862d69c646755c429786

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8964464.exe
Filesize
172KB

MD5
e201a8417dc3ba8a723cf034314747b2

SHA1
87a4a235d1f99f3cc5da67c373429a2eeddc62e4

SHA256
0e66f74658bdd9cd28ee022177b35ee00d53af8030f0e3ac9d8394af19fa40a8

SHA512
6d9c550a10f133c792430b8731e9e2d6f0c66dbb55aa48a1ba95fe46d59161f452af45f166eec1f1567590cdaf580728990cca3f1ba9862d69c646755c429786

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8239880.exe
Filesize
202KB

MD5
3e91d07dd3252334b4f1721274ba61b3

SHA1
50b833cb9b53eaf3b703edadfbd37565188eba49

SHA256
65fbfd6f670294edf780faf988980cc250dd2b5cf9449a04ec3df45f8080cf04

SHA512
5c880420801d3184194449442686670af9114069e192e485af59796ebf5049aa097fa5f0cbdd5e3ee5a64801739c321f5d1579740806500d39e361cde9ea8b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8239880.exe
Filesize
202KB

MD5
3e91d07dd3252334b4f1721274ba61b3

SHA1
50b833cb9b53eaf3b703edadfbd37565188eba49

SHA256
65fbfd6f670294edf780faf988980cc250dd2b5cf9449a04ec3df45f8080cf04

SHA512
5c880420801d3184194449442686670af9114069e192e485af59796ebf5049aa097fa5f0cbdd5e3ee5a64801739c321f5d1579740806500d39e361cde9ea8b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8898709.exe
Filesize
13KB

MD5
f10ebd295c5b2310fbc935f1aa664f72

SHA1
2075475ae14eb856de3f773ea8ff5929a4c8ad3a

SHA256
74cce623f988b8ec798d8185be8c6e35066c6ceb0352c4e16322c2a82851adcc

SHA512
5a927dc851129555dccebf39f579ad1fc629cd45388db974155143415792d7f38a50dd9929d524b29c6dddb3c5e4ca7682e4eb14ff6b4d7fb3474c090d606c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8898709.exe
Filesize
13KB

MD5
f10ebd295c5b2310fbc935f1aa664f72

SHA1
2075475ae14eb856de3f773ea8ff5929a4c8ad3a

SHA256
74cce623f988b8ec798d8185be8c6e35066c6ceb0352c4e16322c2a82851adcc

SHA512
5a927dc851129555dccebf39f579ad1fc629cd45388db974155143415792d7f38a50dd9929d524b29c6dddb3c5e4ca7682e4eb14ff6b4d7fb3474c090d606c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4148499.exe
Filesize
117KB

MD5
478ab926abb781190942ba9630832346

SHA1
f59a38423864bac23aa5d104f2f31ca035529f13

SHA256
0033f2e16a2fabd8c28f543b9b0a0215d236f4a5c02e254b53aa75ba3a42f868

SHA512
b8795f600b5a55e0eb0cfcc1f586943b6a15ff8eca70de79da6ac47e37cc9fd47d30f8a5c800e9021215654c8a420a4382783e53a15e01c7db498fae8221aeb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4148499.exe
Filesize
117KB

MD5
478ab926abb781190942ba9630832346

SHA1
f59a38423864bac23aa5d104f2f31ca035529f13

SHA256
0033f2e16a2fabd8c28f543b9b0a0215d236f4a5c02e254b53aa75ba3a42f868

SHA512
b8795f600b5a55e0eb0cfcc1f586943b6a15ff8eca70de79da6ac47e37cc9fd47d30f8a5c800e9021215654c8a420a4382783e53a15e01c7db498fae8221aeb9

Download Submit
memory/3044-175-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/3044-176-0x00000000052B0000-0x00000000058C8000-memory.dmp

Filesize
6.1MB

Download
memory/3044-177-0x0000000004DA0000-0x0000000004EAA000-memory.dmp

Filesize
1.0MB

Download
memory/3044-178-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

Filesize
72KB

Download
memory/3044-179-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/3044-180-0x0000000004D30000-0x0000000004D6C000-memory.dmp

Filesize
240KB

Download
memory/3044-182-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/3684-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4648-161-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download