redline | 95f8e33e3521a344acb4b2adcd51f9aad0bb29d2b34ea3687110716634ee82ac

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e1ca0bd90280d91624e5ec9748acc83.exe
Size 585KB
Sample230606-lrl6ysda87
SHA256 95f8e33e3521a344acb4b2adcd51f9aad0bb29d2b34ea3687110716634ee82ac
MD5 2e1ca0bd90280d91624e5ec9748acc83
SHA1 86c7940b79b29339f70f34527496457219d9a5c8
SHA512 7b9509be53d35ec9d1f325eb6b65d6369ddd299bdf2e0f5eb04c540472641c87d5be3b638c7bdf753eaf7a030e0bd28e8592abee2798ea142b66f8ae34e54d7a
SSDEEP 6144:K7y+bnr+Qp0yN90QEES2fwtQlnmWSAtzYRYmvppM0AO5O7wLyh/4bXylYJJ0qImr:VMr4y90ChfUWBti9I/F76qmBeElOhFw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5893062.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5893062.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5893062.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5893062.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5893062.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5893062.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4624	y9781423.exe
4588	y4313901.exe
4344	k5893062.exe
2608	l5242398.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5893062.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9781423.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4313901.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4313901.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2e1ca0bd90280d91624e5ec9748acc83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2e1ca0bd90280d91624e5ec9748acc83.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9781423.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{195DF879-020F-443C-9DBA-D14EF0920279}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4BFF3A5D-57FE-4A56-83FC-B5049D1D46DD}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4344	k5893062.exe
4344	k5893062.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	k5893062.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4624	2320	2e1ca0bd90280d91624e5ec9748acc83.exe	82
PID 2320 wrote to memory of 4624	2320	2e1ca0bd90280d91624e5ec9748acc83.exe	82
PID 2320 wrote to memory of 4624	2320	2e1ca0bd90280d91624e5ec9748acc83.exe	82
PID 4624 wrote to memory of 4588	4624	y9781423.exe	83
PID 4624 wrote to memory of 4588	4624	y9781423.exe	83
PID 4624 wrote to memory of 4588	4624	y9781423.exe	83
PID 4588 wrote to memory of 4344	4588	y4313901.exe	84
PID 4588 wrote to memory of 4344	4588	y4313901.exe	84
PID 4588 wrote to memory of 2608	4588	y4313901.exe	87
PID 4588 wrote to memory of 2608	4588	y4313901.exe	87
PID 4588 wrote to memory of 2608	4588	y4313901.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e1ca0bd90280d91624e5ec9748acc83.exe
"C:\Users\Admin\AppData\Local\Temp\2e1ca0bd90280d91624e5ec9748acc83.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9781423.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9781423.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4313901.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4313901.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5893062.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5893062.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5242398.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5242398.exe
      4⤵
      Executes dropped EXE
      PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y9781423.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9781423.exe
Size 377KB
SHA256 f72b5100b746d36377b5b2d3fbfa13491cd2a44579e6eedf4b48dfd11b9edebb
MD5 7aa185b807a934259a0280e99f1cc104
SHA1 464a1b00bad09568c089d08c9ab2c6d90feb07da
SHA512 701ec49cbc923777ae60b50b715647f9fa6dd06df0b8c2f067418d51137520e2b1365a2f2367f39f3a723272c3647692ddcbd69798401da3ec57e0708418f157
SSDEEP 6144:KPy+bnr+kp0yN90QEkoMpF2ZT78RYmvppMdAO5OuNLyi/4bXylY3J0qIJp:tMroy90WoigN729I+FuIqJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

y9781423.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9781423.exe
Size 377KB
SHA256 f72b5100b746d36377b5b2d3fbfa13491cd2a44579e6eedf4b48dfd11b9edebb
MD5 7aa185b807a934259a0280e99f1cc104
SHA1 464a1b00bad09568c089d08c9ab2c6d90feb07da
SHA512 701ec49cbc923777ae60b50b715647f9fa6dd06df0b8c2f067418d51137520e2b1365a2f2367f39f3a723272c3647692ddcbd69798401da3ec57e0708418f157
SSDEEP 6144:KPy+bnr+kp0yN90QEkoMpF2ZT78RYmvppMdAO5OuNLyi/4bXylY3J0qIJp:tMroy90WoigN729I+FuIqJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4313901.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4313901.exe
Size 206KB
SHA256 1917e793b9f946943c53a9b1f6dc20f7dc0f44b8b360ee07f45b406912ac9c85
MD5 2a2a461b08133e0853c87d81e280d62d
SHA1 0e5782c6a6e4b88d9b7f9a39a76391dc90bc9131
SHA512 008aec9aa88bec72bb106c1a20d2a878a16ab993a703224121394c0c8a5dd2b714a86995e41f4045d8fcea8340b656fcb22275afccfea6b651723571a8a37cb8
SSDEEP 6144:Khy+bnr+Ap0yN90QE0n9XiYBtnJSir92:jMrYy90qnhvHJSo92
MD5 SHA1 SHA512 SSDEEP

Submit Download

y4313901.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4313901.exe
Size 206KB
SHA256 1917e793b9f946943c53a9b1f6dc20f7dc0f44b8b360ee07f45b406912ac9c85
MD5 2a2a461b08133e0853c87d81e280d62d
SHA1 0e5782c6a6e4b88d9b7f9a39a76391dc90bc9131
SHA512 008aec9aa88bec72bb106c1a20d2a878a16ab993a703224121394c0c8a5dd2b714a86995e41f4045d8fcea8340b656fcb22275afccfea6b651723571a8a37cb8
SSDEEP 6144:Khy+bnr+Ap0yN90QE0n9XiYBtnJSir92:jMrYy90qnhvHJSo92
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5893062.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5893062.exe
Size 13KB
SHA256 8dba03ec5b19f7c241ed425a0c706952f55f6e83df7728f16822ba21d7477a3e
MD5 4b6a1a2c1d47814b8d2cb15acdc2388b
SHA1 9b18a65e7ab6c4ee38bc438a6acc53ec5eb1353b
SHA512 328436785d1366d1e8e24e9ede70e2dc81987442d388cef8a9335cc2f4f8bee5e789c5e296c25b6495225c8356afb85b522a651f88005e369778d88e2bb14256
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

k5893062.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5893062.exe
Size 13KB
SHA256 8dba03ec5b19f7c241ed425a0c706952f55f6e83df7728f16822ba21d7477a3e
MD5 4b6a1a2c1d47814b8d2cb15acdc2388b
SHA1 9b18a65e7ab6c4ee38bc438a6acc53ec5eb1353b
SHA512 328436785d1366d1e8e24e9ede70e2dc81987442d388cef8a9335cc2f4f8bee5e789c5e296c25b6495225c8356afb85b522a651f88005e369778d88e2bb14256
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5242398.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5242398.exe
Size 172KB
SHA256 e95e8c0fa1262d92f2bfd1fe3f433f16087eb0381191c729f0430ebfbb0fde48
MD5 ff9f7d9bd24fbaa94fbb85b9e867f5d0
SHA1 c5229ef225298ec981282958dfcefd7c77fd2fc9
SHA512 f482ec360512ff347a2e5537ad99c2f55c92d614a96b853784b9e39f02d8f79895d82513c6e31f2fd379018c91880f2204a4c76dbf2787dec7a9b9e64d932fc6
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

l5242398.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5242398.exe
Size 172KB
SHA256 e95e8c0fa1262d92f2bfd1fe3f433f16087eb0381191c729f0430ebfbb0fde48
MD5 ff9f7d9bd24fbaa94fbb85b9e867f5d0
SHA1 c5229ef225298ec981282958dfcefd7c77fd2fc9
SHA512 f482ec360512ff347a2e5537ad99c2f55c92d614a96b853784b9e39f02d8f79895d82513c6e31f2fd379018c91880f2204a4c76dbf2787dec7a9b9e64d932fc6
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2608-161-0x0000000000700000-0x0000000000730000-memory.dmp

Download

memory/2608-166-0x000000000AB40000-0x000000000B158000-memory.dmp

Download

memory/2608-169-0x000000000A680000-0x000000000A78A000-memory.dmp

Download

memory/2608-170-0x000000000A5C0000-0x000000000A5D2000-memory.dmp

Download

memory/2608-171-0x000000000A620000-0x000000000A65C000-memory.dmp

Download

memory/2608-172-0x0000000005090000-0x00000000050A0000-memory.dmp

Download

memory/2608-173-0x0000000005090000-0x00000000050A0000-memory.dmp

Download

memory/4344-154-0x0000000000910000-0x000000000091A000-memory.dmp

Download