redline | db519513e0ae73534a2017a965856adcb26101c3e13b25e34c93480d13035f86

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

735KB
MD5

fbe0e58b064be5e45504f02dc19ad4a0
SHA1

02ada666b568937878653b14b4fd2eae1e5e9c92
SHA256

db519513e0ae73534a2017a965856adcb26101c3e13b25e34c93480d13035f86
SHA512

db7649131471e87122f86660db88391f4eb41d463cec92ead57cf87cffffdbad12923762d43f14460207e4e42969d4bcd764ff4237444e6e1a15d22c7f68d060
SSDEEP

12288:RMrSy90gI5Y4/9j1rJUHqFbD7im7cgPPXvSO1e5aFFBUr9hhFVGo8wjM2JFyImb:by5I+4/3rOHqF3T77SO188FBUr9zn8wa

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exea0498263.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0498263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0498263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0498263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0498263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a0498263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0498263.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v2581480.exev1898424.exev4564723.exea0498263.exeb4838778.exec1223515.exe

pid process

3496 v2581480.exe
852 v1898424.exe
4240 v4564723.exe
1540 a0498263.exe
1872 b4838778.exe
5104 c1223515.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a0498263.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0498263.exe

pid	process
3496	v2581480.exe
852	v1898424.exe
4240	v4564723.exe
1540	a0498263.exe
1872	b4838778.exe
5104	c1223515.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0498263.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exev2581480.exev1898424.exev4564723.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2581480.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2581480.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1898424.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1898424.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v4564723.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v4564723.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4838778.exe

description pid process target process

PID 1872 set thread context of 4012 1872 b4838778.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3292 1872 WerFault.exe b4838778.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a0498263.exeAppLaunch.exe

pid process

1540 a0498263.exe
1540 a0498263.exe
4012 AppLaunch.exe
4012 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a0498263.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 1540 a0498263.exe
Token: SeDebugPrivilege 4012 AppLaunch.exe

description	pid	process	target process
PID 1872 set thread context of 4012	1872	b4838778.exe	AppLaunch.exe

pid	pid_target	process	target process
3292	1872	WerFault.exe	b4838778.exe

pid	process
1540	a0498263.exe
1540	a0498263.exe
4012	AppLaunch.exe
4012	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1540	a0498263.exe
Token: SeDebugPrivilege	4012	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

file.exev2581480.exev1898424.exev4564723.exeb4838778.exe

description	pid	process	target process
PID 4216 wrote to memory of 3496	4216	file.exe	v2581480.exe
PID 4216 wrote to memory of 3496	4216	file.exe	v2581480.exe
PID 4216 wrote to memory of 3496	4216	file.exe	v2581480.exe
PID 3496 wrote to memory of 852	3496	v2581480.exe	v1898424.exe
PID 3496 wrote to memory of 852	3496	v2581480.exe	v1898424.exe
PID 3496 wrote to memory of 852	3496	v2581480.exe	v1898424.exe
PID 852 wrote to memory of 4240	852	v1898424.exe	v4564723.exe
PID 852 wrote to memory of 4240	852	v1898424.exe	v4564723.exe
PID 852 wrote to memory of 4240	852	v1898424.exe	v4564723.exe
PID 4240 wrote to memory of 1540	4240	v4564723.exe	a0498263.exe
PID 4240 wrote to memory of 1540	4240	v4564723.exe	a0498263.exe
PID 4240 wrote to memory of 1872	4240	v4564723.exe	b4838778.exe
PID 4240 wrote to memory of 1872	4240	v4564723.exe	b4838778.exe
PID 4240 wrote to memory of 1872	4240	v4564723.exe	b4838778.exe
PID 1872 wrote to memory of 4012	1872	b4838778.exe	AppLaunch.exe
PID 1872 wrote to memory of 4012	1872	b4838778.exe	AppLaunch.exe
PID 1872 wrote to memory of 4012	1872	b4838778.exe	AppLaunch.exe
PID 1872 wrote to memory of 4012	1872	b4838778.exe	AppLaunch.exe
PID 1872 wrote to memory of 4012	1872	b4838778.exe	AppLaunch.exe
PID 852 wrote to memory of 5104	852	v1898424.exe	c1223515.exe
PID 852 wrote to memory of 5104	852	v1898424.exe	c1223515.exe
PID 852 wrote to memory of 5104	852	v1898424.exe	c1223515.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4216

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2581480.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2581480.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3496

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1898424.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1898424.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4564723.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4564723.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4240

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0498263.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0498263.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4838778.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4838778.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 148
6⤵
- Program crash
PID:3292

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1223515.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1223515.exe
4⤵
- Executes dropped EXE
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1872 -ip 1872
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2581480.exe
Filesize
530KB

MD5
05680964af49b907add9defb6ceb9627

SHA1
d4d91ca36b40624e03639cb772d7d6a4bc480a03

SHA256
fab7cffee190939b499e7f17e4879ba4a1d2ca564c3e2a1f52752f17cf5988db

SHA512
e9d72a231f9e6d1b95783cc9c5ec645f4c52fa6eccfbd0db49e55e30a3fdcda709d7fa46c797d851a39d62addb68b60b8ab46e98030f96d5ee3335e9696aff23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2581480.exe
Filesize
530KB

MD5
05680964af49b907add9defb6ceb9627

SHA1
d4d91ca36b40624e03639cb772d7d6a4bc480a03

SHA256
fab7cffee190939b499e7f17e4879ba4a1d2ca564c3e2a1f52752f17cf5988db

SHA512
e9d72a231f9e6d1b95783cc9c5ec645f4c52fa6eccfbd0db49e55e30a3fdcda709d7fa46c797d851a39d62addb68b60b8ab46e98030f96d5ee3335e9696aff23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1898424.exe
Filesize
357KB

MD5
ba8aa39ffe4b079e0266cf9bb19cd9b1

SHA1
1d7c1c0f9cf808b71c147561383247efcb409d48

SHA256
14c3fdab17cdf114ac96ceab1e699a45cd65fcb7ef11192c27c60679a74039fd

SHA512
01ffce9d9c7545d11d69894089d4a086660aa0133b726dabea9c2048d89794b5dfd104c44419847b0249cb10d7b6b9b0984ccefabdab96089a262cf2895ffee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1898424.exe
Filesize
357KB

MD5
ba8aa39ffe4b079e0266cf9bb19cd9b1

SHA1
1d7c1c0f9cf808b71c147561383247efcb409d48

SHA256
14c3fdab17cdf114ac96ceab1e699a45cd65fcb7ef11192c27c60679a74039fd

SHA512
01ffce9d9c7545d11d69894089d4a086660aa0133b726dabea9c2048d89794b5dfd104c44419847b0249cb10d7b6b9b0984ccefabdab96089a262cf2895ffee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1223515.exe
Filesize
172KB

MD5
b27cffe9d3efb84b0b5362e0cf3970d8

SHA1
8331724079e9d63e0984b13bff4d17f1d1d675a0

SHA256
5d4562248473b017d2edf1726f6a85352f00b923623c6b8152701f6fb31e2ee7

SHA512
105147e9345f18b09df671445d9aca22f2e542f268fca38eeef1a0da38406e0c85c3c78513fa5778e8d028fe669ad2d41404977f1f92e249a4c4fe1def09dbf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1223515.exe
Filesize
172KB

MD5
b27cffe9d3efb84b0b5362e0cf3970d8

SHA1
8331724079e9d63e0984b13bff4d17f1d1d675a0

SHA256
5d4562248473b017d2edf1726f6a85352f00b923623c6b8152701f6fb31e2ee7

SHA512
105147e9345f18b09df671445d9aca22f2e542f268fca38eeef1a0da38406e0c85c3c78513fa5778e8d028fe669ad2d41404977f1f92e249a4c4fe1def09dbf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4564723.exe
Filesize
202KB

MD5
f05cdaae644cf19e1a1e470d42a692d4

SHA1
69a5ecc920acfb087aba760a8cefae6011c7aa18

SHA256
0e7212c886c8ec885f35f819f89dcb07d74065a6a023b0230dd8e05cddac1d54

SHA512
0335e9bee65bbea278cfbe845907727321296695a9ddd103c9c07fb7a2e171fee61e88bb6ef9f488768d78c2c6c6a7cf0a21574aef273dc1bc5d6bd9c4ed949c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4564723.exe
Filesize
202KB

MD5
f05cdaae644cf19e1a1e470d42a692d4

SHA1
69a5ecc920acfb087aba760a8cefae6011c7aa18

SHA256
0e7212c886c8ec885f35f819f89dcb07d74065a6a023b0230dd8e05cddac1d54

SHA512
0335e9bee65bbea278cfbe845907727321296695a9ddd103c9c07fb7a2e171fee61e88bb6ef9f488768d78c2c6c6a7cf0a21574aef273dc1bc5d6bd9c4ed949c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0498263.exe
Filesize
13KB

MD5
4b74fbbfc2a358c2f947f15eb03bf83a

SHA1
87b4a7c61212d00b66ac4fbc773149a5f978952b

SHA256
e30b182b4c629576911a232b2a9d0ce41d47d4983be756947f6f694556f94d2f

SHA512
cc0408d26048279a4fa4edf54d1bd3520e8b8d9254a0d439b3bf600e325fb302af200031d136e235bbed36ad063e2c285b98b740b25b31da176c0d443c71a91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0498263.exe
Filesize
13KB

MD5
4b74fbbfc2a358c2f947f15eb03bf83a

SHA1
87b4a7c61212d00b66ac4fbc773149a5f978952b

SHA256
e30b182b4c629576911a232b2a9d0ce41d47d4983be756947f6f694556f94d2f

SHA512
cc0408d26048279a4fa4edf54d1bd3520e8b8d9254a0d439b3bf600e325fb302af200031d136e235bbed36ad063e2c285b98b740b25b31da176c0d443c71a91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4838778.exe
Filesize
117KB

MD5
696894f73314292e4170c593342c94e8

SHA1
ed867ec99d42290d4997fbea8633d6167636e90f

SHA256
eef627ec40ef0737b5011c30ddb3d84e40fd56fab8baf02577ea2eeeac7cbe05

SHA512
1fe1c0950f507ad6a7c8662829218540480b96f098743c876baa2d1541e19d58aae7c9d3b209c43e9e053b2993e686fd1a27e17d3f27bafde565af3f89a4fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4838778.exe
Filesize
117KB

MD5
696894f73314292e4170c593342c94e8

SHA1
ed867ec99d42290d4997fbea8633d6167636e90f

SHA256
eef627ec40ef0737b5011c30ddb3d84e40fd56fab8baf02577ea2eeeac7cbe05

SHA512
1fe1c0950f507ad6a7c8662829218540480b96f098743c876baa2d1541e19d58aae7c9d3b209c43e9e053b2993e686fd1a27e17d3f27bafde565af3f89a4fd56

Download Submit
memory/1540-161-0x00000000000A0000-0x00000000000AA000-memory.dmp

Filesize
40KB

Download
memory/4012-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5104-175-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/5104-176-0x000000000B0F0000-0x000000000B708000-memory.dmp

Filesize
6.1MB

Download
memory/5104-177-0x000000000AC50000-0x000000000AD5A000-memory.dmp

Filesize
1.0MB

Download
memory/5104-178-0x000000000AB90000-0x000000000ABA2000-memory.dmp

Filesize
72KB

Download
memory/5104-179-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/5104-180-0x000000000ABF0000-0x000000000AC2C000-memory.dmp

Filesize
240KB

Download
memory/5104-182-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download