redline | be5823c29efaa6892b51a79052ffe4dec799fba75242ffa3427f020712fe0115

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30ab384ff7528abb56b2bc2172324ee7.exe
Size 584KB
Sample230606-lnrx2ada65
SHA256 be5823c29efaa6892b51a79052ffe4dec799fba75242ffa3427f020712fe0115
MD5 30ab384ff7528abb56b2bc2172324ee7
SHA1 1f59cd7b66fa481aae17dcd646acb4f2de91a80f
SHA512 62663aa7528727f6ddeb2bc414f443490b6052437f3989036dbce3b63c6a1c7c23cf5f1fc22560232f118415a2309ea692621a98b335483a9f979d9c08d864f6
SSDEEP 12288:XMr2y90tnAKgqF8f5jX9qElOkxNUAS+x9qTf5FmZ7:RyWLgJNXICNV96f5M7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8526673.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8526673.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8526673.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8526673.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8526673.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k8526673.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2916	y7919635.exe
1828	y4940874.exe
1868	k8526673.exe
3716	l9603981.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8526673.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7919635.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4940874.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4940874.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	30ab384ff7528abb56b2bc2172324ee7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30ab384ff7528abb56b2bc2172324ee7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7919635.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1868	k8526673.exe
1868	k8526673.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe
3716	l9603981.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	k8526673.exe
Token: SeDebugPrivilege	3716	l9603981.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2916	5036	30ab384ff7528abb56b2bc2172324ee7.exe	85
PID 5036 wrote to memory of 2916	5036	30ab384ff7528abb56b2bc2172324ee7.exe	85
PID 5036 wrote to memory of 2916	5036	30ab384ff7528abb56b2bc2172324ee7.exe	85
PID 2916 wrote to memory of 1828	2916	y7919635.exe	86
PID 2916 wrote to memory of 1828	2916	y7919635.exe	86
PID 2916 wrote to memory of 1828	2916	y7919635.exe	86
PID 1828 wrote to memory of 1868	1828	y4940874.exe	87
PID 1828 wrote to memory of 1868	1828	y4940874.exe	87
PID 1828 wrote to memory of 3716	1828	y4940874.exe	90
PID 1828 wrote to memory of 3716	1828	y4940874.exe	90
PID 1828 wrote to memory of 3716	1828	y4940874.exe	90

C:\Users\Admin\AppData\Local\Temp\30ab384ff7528abb56b2bc2172324ee7.exe
"C:\Users\Admin\AppData\Local\Temp\30ab384ff7528abb56b2bc2172324ee7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7919635.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7919635.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4940874.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4940874.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8526673.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8526673.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9603981.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9603981.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y7919635.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7919635.exe
Size 377KB
SHA256 ba4991f3e1f58607ca0f409bbd75956acea64dfc3f5cbcb4c03032e8f7440d65
MD5 59d1c411f79d6135b44e9dc8f4db7f6c
SHA1 8f581e89c7ecd02ad15261f2f1148d4e7200ceba
SHA512 8ee8d9ed13d44209e4d947953e196d43925f9345e074dc5b6b1383b43ac86b37df120c2deb708b5dd0aff91f234d628162cb9d06615a0ad5aae0b4212e7aba77
SSDEEP 6144:Kfy+bnr+9p0yN90QEOnwh13CPs4kITHdd995GdQ4xyP0GNoGjIxX:VMrxy90M413CPsWX9KWlDkxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

y7919635.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7919635.exe
Size 377KB
SHA256 ba4991f3e1f58607ca0f409bbd75956acea64dfc3f5cbcb4c03032e8f7440d65
MD5 59d1c411f79d6135b44e9dc8f4db7f6c
SHA1 8f581e89c7ecd02ad15261f2f1148d4e7200ceba
SHA512 8ee8d9ed13d44209e4d947953e196d43925f9345e074dc5b6b1383b43ac86b37df120c2deb708b5dd0aff91f234d628162cb9d06615a0ad5aae0b4212e7aba77
SSDEEP 6144:Kfy+bnr+9p0yN90QEOnwh13CPs4kITHdd995GdQ4xyP0GNoGjIxX:VMrxy90M413CPsWX9KWlDkxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4940874.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4940874.exe
Size 206KB
SHA256 a39bc471bc552da3fd175f452a33c0be49436ccd611212b31773015f0a29fcd0
MD5 3fce1448fe833f6b88e33c023a9e7479
SHA1 b0432a7ed190f038de260a096f105f16dff0e9c7
SHA512 3cc6f54f703074c39c6e7c987214cad123897a6f33217f0c1838a183d7a8749f510e5669e410ecd62ee95ad1f8eaafcdfb4e1b2026c28bd5932b7d63f0eee610
SSDEEP 6144:KDy+bnr+qp0yN90QE+T7lp5yLENIlXzfLb:ZMruy9087ljy4Sn
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4940874.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4940874.exe
Size 206KB
SHA256 a39bc471bc552da3fd175f452a33c0be49436ccd611212b31773015f0a29fcd0
MD5 3fce1448fe833f6b88e33c023a9e7479
SHA1 b0432a7ed190f038de260a096f105f16dff0e9c7
SHA512 3cc6f54f703074c39c6e7c987214cad123897a6f33217f0c1838a183d7a8749f510e5669e410ecd62ee95ad1f8eaafcdfb4e1b2026c28bd5932b7d63f0eee610
SSDEEP 6144:KDy+bnr+qp0yN90QE+T7lp5yLENIlXzfLb:ZMruy9087ljy4Sn
MD5 SHA1 SHA512 SSDEEP

Submit Download

k8526673.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8526673.exe
Size 13KB
SHA256 4452b61eed8a45579f90bc9bb172aeb52730c391cc491f38fc7467a311e216ae
MD5 3fbf1ff2eb7adf9ed319604a57a1e252
SHA1 c9ece7b47f6c681a23d03532374525de9ed396b9
SHA512 79b3c233bf3c3c5f182ede4f33c85e646fe20ea905f34091384573cf7c12d7fe979b2300286e4cf7bf64a5b166223a0ba44ed042637eed671a383717d976f9c2
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k8526673.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8526673.exe
Size 13KB
SHA256 4452b61eed8a45579f90bc9bb172aeb52730c391cc491f38fc7467a311e216ae
MD5 3fbf1ff2eb7adf9ed319604a57a1e252
SHA1 c9ece7b47f6c681a23d03532374525de9ed396b9
SHA512 79b3c233bf3c3c5f182ede4f33c85e646fe20ea905f34091384573cf7c12d7fe979b2300286e4cf7bf64a5b166223a0ba44ed042637eed671a383717d976f9c2
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9603981.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9603981.exe
Size 172KB
SHA256 87b9ac937f2fd213588e0d2be3dd89bbcf5c4035b5eded8be251aff45ff6ebc6
MD5 60c49bc4b785fe217052479a8c2b7628
SHA1 f6282fc4cd634f025fd78eff8db59209872fadca
SHA512 1270c154befdc44b62fe659eb149e6bce62baf2de519ba2c6a77c3e9c1a6ef835721c680fe43db7c9c6ae42320e8c8dac6f2379f75662b445adb6e7644f5c58a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l9603981.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9603981.exe
Size 172KB
SHA256 87b9ac937f2fd213588e0d2be3dd89bbcf5c4035b5eded8be251aff45ff6ebc6
MD5 60c49bc4b785fe217052479a8c2b7628
SHA1 f6282fc4cd634f025fd78eff8db59209872fadca
SHA512 1270c154befdc44b62fe659eb149e6bce62baf2de519ba2c6a77c3e9c1a6ef835721c680fe43db7c9c6ae42320e8c8dac6f2379f75662b445adb6e7644f5c58a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1868-154-0x00000000004F0000-0x00000000004FA000-memory.dmp

Download

memory/3716-160-0x000000000A910000-0x000000000AF28000-memory.dmp

Download

memory/3716-166-0x000000000A710000-0x000000000A7A2000-memory.dmp

Download

memory/3716-161-0x000000000A400000-0x000000000A50A000-memory.dmp

Download

memory/3716-162-0x0000000004EF0000-0x0000000004F02000-memory.dmp

Download

memory/3716-163-0x000000000A2F0000-0x000000000A32C000-memory.dmp

Download

memory/3716-164-0x0000000004F60000-0x0000000004F70000-memory.dmp

Download

memory/3716-165-0x000000000A5F0000-0x000000000A666000-memory.dmp

Download

memory/3716-159-0x0000000000500000-0x0000000000530000-memory.dmp

Download

memory/3716-167-0x000000000B4E0000-0x000000000BA84000-memory.dmp

Download

memory/3716-168-0x000000000AF30000-0x000000000AF96000-memory.dmp

Download

memory/3716-169-0x000000000BA90000-0x000000000BC52000-memory.dmp

Download

memory/3716-170-0x000000000C190000-0x000000000C6BC000-memory.dmp

Download

memory/3716-171-0x0000000004F60000-0x0000000004F70000-memory.dmp

Download

memory/3716-172-0x000000000B480000-0x000000000B4D0000-memory.dmp

Download