redline | e0077fc1e1b3dd703bdb1876f2afa8e2e2bb8a1601d59bb37a04cb8d33c82859

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02722599.exe
Size

737KB
MD5

6095c88b3936c406a8045c6f4dfaad2a
SHA1

73a8f5eafa7ac6ab8c5a37fad223f0ebafc07460
SHA256

e0077fc1e1b3dd703bdb1876f2afa8e2e2bb8a1601d59bb37a04cb8d33c82859
SHA512

fcc9a6f846e78c601e12ae9244b773060cc18617df5b7974a8c2f289c87a310802a75625c3ba00591836b98d793a4ff1aceb3df0950fc40274db6cfde09fc217
SSDEEP

12288:VMrvy90nwpto++zBM5AfTq06XUCxlQoRPGG4J176Y+uq14ENCcYkt:eyLpto+mC5x0QUCxVP6JYmK4DcY0

Score

10^/10

redline maxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a6340837.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6340837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6340837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6340837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6340837.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6340837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6340837.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v6066941.exev1814385.exev5237814.exea6340837.exeb5336328.exec4192028.exe

pid process

5036 v6066941.exe
4144 v1814385.exe
4376 v5237814.exe
1468 a6340837.exe
1124 b5336328.exe
2288 c4192028.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a6340837.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6340837.exe

pid	process
5036	v6066941.exe
4144	v1814385.exe
4376	v5237814.exe
1468	a6340837.exe
1124	b5336328.exe
2288	c4192028.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6340837.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v6066941.exev1814385.exev5237814.exe02722599.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6066941.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1814385.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1814385.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5237814.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5237814.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	02722599.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02722599.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6066941.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

b5336328.exe

description pid process target process

PID 1124 set thread context of 3472 1124 b5336328.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4232 1124 WerFault.exe b5336328.exe

description	pid	process	target process
PID 1124 set thread context of 3472	1124	b5336328.exe	AppLaunch.exe

pid	pid_target	process	target process
4232	1124	WerFault.exe	b5336328.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

a6340837.exeAppLaunch.exec4192028.exe

pid	process
1468	a6340837.exe
1468	a6340837.exe
3472	AppLaunch.exe
3472	AppLaunch.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe
2288	c4192028.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a6340837.exeAppLaunch.exec4192028.exe

description pid process

Token: SeDebugPrivilege 1468 a6340837.exe
Token: SeDebugPrivilege 3472 AppLaunch.exe
Token: SeDebugPrivilege 2288 c4192028.exe

description	pid	process
Token: SeDebugPrivilege	1468	a6340837.exe
Token: SeDebugPrivilege	3472	AppLaunch.exe
Token: SeDebugPrivilege	2288	c4192028.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

02722599.exev6066941.exev1814385.exev5237814.exeb5336328.exe

description	pid	process	target process
PID 2136 wrote to memory of 5036	2136	02722599.exe	v6066941.exe
PID 2136 wrote to memory of 5036	2136	02722599.exe	v6066941.exe
PID 2136 wrote to memory of 5036	2136	02722599.exe	v6066941.exe
PID 5036 wrote to memory of 4144	5036	v6066941.exe	v1814385.exe
PID 5036 wrote to memory of 4144	5036	v6066941.exe	v1814385.exe
PID 5036 wrote to memory of 4144	5036	v6066941.exe	v1814385.exe
PID 4144 wrote to memory of 4376	4144	v1814385.exe	v5237814.exe
PID 4144 wrote to memory of 4376	4144	v1814385.exe	v5237814.exe
PID 4144 wrote to memory of 4376	4144	v1814385.exe	v5237814.exe
PID 4376 wrote to memory of 1468	4376	v5237814.exe	a6340837.exe
PID 4376 wrote to memory of 1468	4376	v5237814.exe	a6340837.exe
PID 4376 wrote to memory of 1124	4376	v5237814.exe	b5336328.exe
PID 4376 wrote to memory of 1124	4376	v5237814.exe	b5336328.exe
PID 4376 wrote to memory of 1124	4376	v5237814.exe	b5336328.exe
PID 1124 wrote to memory of 3472	1124	b5336328.exe	AppLaunch.exe
PID 1124 wrote to memory of 3472	1124	b5336328.exe	AppLaunch.exe
PID 1124 wrote to memory of 3472	1124	b5336328.exe	AppLaunch.exe
PID 1124 wrote to memory of 3472	1124	b5336328.exe	AppLaunch.exe
PID 1124 wrote to memory of 3472	1124	b5336328.exe	AppLaunch.exe
PID 4144 wrote to memory of 2288	4144	v1814385.exe	c4192028.exe
PID 4144 wrote to memory of 2288	4144	v1814385.exe	c4192028.exe
PID 4144 wrote to memory of 2288	4144	v1814385.exe	c4192028.exe

C:\Users\Admin\AppData\Local\Temp\02722599.exe
"C:\Users\Admin\AppData\Local\Temp\02722599.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6066941.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6066941.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1814385.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1814385.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4144

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5237814.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5237814.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6340837.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6340837.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5336328.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5336328.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 140
6⤵
- Program crash
PID:4232

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4192028.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4192028.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1124 -ip 1124
1⤵
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6066941.exe
Filesize
530KB

MD5
db90645deb6fdc42e33dd60860d88bc1

SHA1
cfffc58d7dba9e8f1afe1941ccea38df66c4d047

SHA256
d71a21ee6aac4edd1a3350e864d14c91bf4e46686ddf2a2b93b275e4d6dd2a6b

SHA512
1f74cb76afcbe9efa57e791fe35bf47c0783e7506493a35f612572b2c0731a86d7c52e50a6a0bf8773732f427550afb9b7862391bdcb6f30e64753c79738b3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6066941.exe
Filesize
530KB

MD5
db90645deb6fdc42e33dd60860d88bc1

SHA1
cfffc58d7dba9e8f1afe1941ccea38df66c4d047

SHA256
d71a21ee6aac4edd1a3350e864d14c91bf4e46686ddf2a2b93b275e4d6dd2a6b

SHA512
1f74cb76afcbe9efa57e791fe35bf47c0783e7506493a35f612572b2c0731a86d7c52e50a6a0bf8773732f427550afb9b7862391bdcb6f30e64753c79738b3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1814385.exe
Filesize
358KB

MD5
84e7e89f88d687f00d0673e7187ab36e

SHA1
c9c7bd91d0abfcea6605fd60de63c1cfe929a31f

SHA256
823db8a6523f564e1ecfeca47469acc7f5477a5b1c97ef665331d65b36dcf9a6

SHA512
5c3d07545ea91883498d28f4daaea1736a01db52731ff1307802326bd9d2081c5a32fe91f59da9a3a5fb9def3ea43bf7f3b7b1c96ec6059b05047e5abec509d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1814385.exe
Filesize
358KB

MD5
84e7e89f88d687f00d0673e7187ab36e

SHA1
c9c7bd91d0abfcea6605fd60de63c1cfe929a31f

SHA256
823db8a6523f564e1ecfeca47469acc7f5477a5b1c97ef665331d65b36dcf9a6

SHA512
5c3d07545ea91883498d28f4daaea1736a01db52731ff1307802326bd9d2081c5a32fe91f59da9a3a5fb9def3ea43bf7f3b7b1c96ec6059b05047e5abec509d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4192028.exe
Filesize
172KB

MD5
776237f4ce10fc76aa8f03fd044553e7

SHA1
e0321cc99f9771881b9dc7cd8c6b3915946625f1

SHA256
d7a735c1b62c49fbdc991ed579c205a2309e34ba8e70eb08683ce44db634d114

SHA512
f6540479a512ccb55315c3a8629497ea41e194351429984789aa063805b2f01ac50a06ae0804b580f21d1c924155e0c325bc71761f6eda361e18111917f9ff65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4192028.exe
Filesize
172KB

MD5
776237f4ce10fc76aa8f03fd044553e7

SHA1
e0321cc99f9771881b9dc7cd8c6b3915946625f1

SHA256
d7a735c1b62c49fbdc991ed579c205a2309e34ba8e70eb08683ce44db634d114

SHA512
f6540479a512ccb55315c3a8629497ea41e194351429984789aa063805b2f01ac50a06ae0804b580f21d1c924155e0c325bc71761f6eda361e18111917f9ff65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5237814.exe
Filesize
203KB

MD5
fd3bdf37bc13b92ce63937fd0a035af4

SHA1
f057fb6229e009d5b44654473a4f818249d1c7cd

SHA256
0f522df93e9f1a292dab9d00c5b056b54e82d62433e61688b4de143c7a453d8a

SHA512
56952d34198b902b607b9462bec0df614ca519f99fd80fd8cacb52ea6bc38707410f58d93e2985642b334f5723742a4b39b19e6b1782f4b5db16f3d0fa23aa50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5237814.exe
Filesize
203KB

MD5
fd3bdf37bc13b92ce63937fd0a035af4

SHA1
f057fb6229e009d5b44654473a4f818249d1c7cd

SHA256
0f522df93e9f1a292dab9d00c5b056b54e82d62433e61688b4de143c7a453d8a

SHA512
56952d34198b902b607b9462bec0df614ca519f99fd80fd8cacb52ea6bc38707410f58d93e2985642b334f5723742a4b39b19e6b1782f4b5db16f3d0fa23aa50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6340837.exe
Filesize
13KB

MD5
599f0c2ae88109722b116af78f77f42d

SHA1
887c827e17c5b428f4f61d618a183d66b88f8dfd

SHA256
0cc6ba9de0bedaa73c34123da7b7a16ecb1abcf43b0dc2b247bd35150177722e

SHA512
d60d04803d700c0fecf62e0428fdd49623e15b3fdaea1dc2e012423afc39be77083511927621378ffbc0cf064ee0ee0e8a8a2da238ed4573204b428f0b9e4485

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6340837.exe
Filesize
13KB

MD5
599f0c2ae88109722b116af78f77f42d

SHA1
887c827e17c5b428f4f61d618a183d66b88f8dfd

SHA256
0cc6ba9de0bedaa73c34123da7b7a16ecb1abcf43b0dc2b247bd35150177722e

SHA512
d60d04803d700c0fecf62e0428fdd49623e15b3fdaea1dc2e012423afc39be77083511927621378ffbc0cf064ee0ee0e8a8a2da238ed4573204b428f0b9e4485

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5336328.exe
Filesize
120KB

MD5
b9c6bcf644ef1ac91f5ac49893741c3c

SHA1
baa494e9ea8e68321b6dfe2268f337e14a8272f7

SHA256
8021ae91ca0b442de2dc99b524ed28f0dc05a8c653d21b206120907d7121bdf6

SHA512
3b4b61ce21b73e816b532c95c300094d235a4e2c27a86a42bebeda39b8a223ce91fe828c8cc7251c4416c23f528989a05ca92a034c3cbd376238306f0fbe91a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5336328.exe
Filesize
120KB

MD5
b9c6bcf644ef1ac91f5ac49893741c3c

SHA1
baa494e9ea8e68321b6dfe2268f337e14a8272f7

SHA256
8021ae91ca0b442de2dc99b524ed28f0dc05a8c653d21b206120907d7121bdf6

SHA512
3b4b61ce21b73e816b532c95c300094d235a4e2c27a86a42bebeda39b8a223ce91fe828c8cc7251c4416c23f528989a05ca92a034c3cbd376238306f0fbe91a6

Download Submit
memory/1468-161-0x0000000000F60000-0x0000000000F6A000-memory.dmp

Filesize
40KB

Download
memory/2288-175-0x00000000002A0000-0x00000000002D0000-memory.dmp

Filesize
192KB

Download
memory/2288-181-0x000000000A4D0000-0x000000000A546000-memory.dmp

Filesize
472KB

Download
memory/2288-176-0x000000000A770000-0x000000000AD88000-memory.dmp

Filesize
6.1MB

Download
memory/2288-177-0x000000000A260000-0x000000000A36A000-memory.dmp

Filesize
1.0MB

Download
memory/2288-178-0x000000000A170000-0x000000000A182000-memory.dmp

Filesize
72KB

Download
memory/2288-179-0x000000000A1D0000-0x000000000A20C000-memory.dmp

Filesize
240KB

Download
memory/2288-180-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2288-188-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2288-182-0x000000000AD90000-0x000000000AE22000-memory.dmp

Filesize
584KB

Download
memory/2288-183-0x000000000A650000-0x000000000A6B6000-memory.dmp

Filesize
408KB

Download
memory/2288-184-0x000000000B6E0000-0x000000000BC84000-memory.dmp

Filesize
5.6MB

Download
memory/2288-186-0x000000000B320000-0x000000000B370000-memory.dmp

Filesize
320KB

Download
memory/2288-187-0x000000000BC90000-0x000000000BE52000-memory.dmp

Filesize
1.8MB

Download
memory/2288-189-0x000000000C390000-0x000000000C8BC000-memory.dmp

Filesize
5.2MB

Download
memory/3472-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download