redline | 7cdf557ac0b26ac8e5dbb41e16d6d6ea7e23d76ca8662aaf808e60e2c45f07c6

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1c7a9d74dc98fbbf44a6adcc0add334.exe
Size

585KB
MD5

b1c7a9d74dc98fbbf44a6adcc0add334
SHA1

ed1b2232e8dc7fdd62d2abcc50889d8822c0e4e4
SHA256

7cdf557ac0b26ac8e5dbb41e16d6d6ea7e23d76ca8662aaf808e60e2c45f07c6
SHA512

8506765ac63e7766f4a0d51d17ba5df2aa48a70ad7260e9df84512b47e10a78a19803f52d3cf2e2910a328cfee546ab133fb274d375039a9232c6d593b3c04e4
SSDEEP

12288:fMr8y90tAsU3nol5LbwNhHhO54EirAI1dhKontSgt:ryoTn4HhO54rAaLKISgt

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4929212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4929212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4929212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4929212.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k4929212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4929212.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1100	y2903753.exe
980	y5571242.exe
676	k4929212.exe
1344	l1207517.exe

Loads dropped DLL 7 IoCs

pid	Process
1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe
1100	y2903753.exe
1100	y2903753.exe
980	y5571242.exe
980	y5571242.exe
980	y5571242.exe
1344	l1207517.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	k4929212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4929212.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b1c7a9d74dc98fbbf44a6adcc0add334.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2903753.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2903753.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y5571242.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5571242.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b1c7a9d74dc98fbbf44a6adcc0add334.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
676	k4929212.exe
676	k4929212.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe
1344	l1207517.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	k4929212.exe
Token: SeDebugPrivilege	1344	l1207517.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1060 wrote to memory of 1100	1060	b1c7a9d74dc98fbbf44a6adcc0add334.exe	28
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 1100 wrote to memory of 980	1100	y2903753.exe	29
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 676	980	y5571242.exe	30
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31
PID 980 wrote to memory of 1344	980	y5571242.exe	31

C:\Users\Admin\AppData\Local\Temp\b1c7a9d74dc98fbbf44a6adcc0add334.exe
"C:\Users\Admin\AppData\Local\Temp\b1c7a9d74dc98fbbf44a6adcc0add334.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4929212.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4929212.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:676
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe

Filesize
377KB

MD5
dc10105e9d919c778fd580e970b22515

SHA1
a45367878c87a2ce68b434968b41a25e69d29992

SHA256
0b6fbbe0bc0fc366c58f139a154d027db3c512e0326911611863e266b318a1e0

SHA512
24e37d2bd54418d2c021203eb5226fc2af2b321cdd761b96ed9adc3ca9010baedf17014c520091ec17016905e0b80417356ae0026b42d42ca2ad44de6e1394c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe

Filesize
377KB

MD5
dc10105e9d919c778fd580e970b22515

SHA1
a45367878c87a2ce68b434968b41a25e69d29992

SHA256
0b6fbbe0bc0fc366c58f139a154d027db3c512e0326911611863e266b318a1e0

SHA512
24e37d2bd54418d2c021203eb5226fc2af2b321cdd761b96ed9adc3ca9010baedf17014c520091ec17016905e0b80417356ae0026b42d42ca2ad44de6e1394c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe

Filesize
206KB

MD5
b3c57d26899a42c3f5bdcad36d1c3590

SHA1
20ebc1e908fbd59e5238bebd78e2d666cdce6863

SHA256
48d245d0ade9a13a6db08fb30bdeeeb3c7f3aa3297d75a61c80b5ceed123e190

SHA512
7f60bca49482216a5840e9cb9f2847177710bf64571e7f91c85c597044a45de9ea036df81e1101bee42c47e91258da6c87b0aae823ce36e5634ca29aa512cc9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe

Filesize
206KB

MD5
b3c57d26899a42c3f5bdcad36d1c3590

SHA1
20ebc1e908fbd59e5238bebd78e2d666cdce6863

SHA256
48d245d0ade9a13a6db08fb30bdeeeb3c7f3aa3297d75a61c80b5ceed123e190

SHA512
7f60bca49482216a5840e9cb9f2847177710bf64571e7f91c85c597044a45de9ea036df81e1101bee42c47e91258da6c87b0aae823ce36e5634ca29aa512cc9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4929212.exe

Filesize
13KB

MD5
a04f642504a844f671c51f6a3a2207fb

SHA1
44edd5736739f8680b1d1e8f140651d8bebad761

SHA256
d8faf4696d989765ffa45949029d15d7e106c3442f709ec05018dd7fec83355c

SHA512
430854adfa2fd9341126493b3af49c7c186004f84ea914b819a3e15342cd42e888c718444b7d0d01a0903539f013e7e45dabe3d63698907761f2739b728bdfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4929212.exe

Filesize
13KB

MD5
a04f642504a844f671c51f6a3a2207fb

SHA1
44edd5736739f8680b1d1e8f140651d8bebad761

SHA256
d8faf4696d989765ffa45949029d15d7e106c3442f709ec05018dd7fec83355c

SHA512
430854adfa2fd9341126493b3af49c7c186004f84ea914b819a3e15342cd42e888c718444b7d0d01a0903539f013e7e45dabe3d63698907761f2739b728bdfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe

Filesize
172KB

MD5
3e1c5d41b6ad6cf7b04027cc7e3a9d00

SHA1
001f71277cf609f6eec734d36b27456a09462189

SHA256
2b749e78508636ffda423f71155cb22172070c6831bc558115afc7171970387f

SHA512
98cff5edbffe7a4ed1d50f6fb5aea8e58556b565ba86ffd0325379278abfc223d7af30c950a7c3818e44c41e7b73fb3cf8a75326134a87a48a59ff17e43ee4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe

Filesize
172KB

MD5
3e1c5d41b6ad6cf7b04027cc7e3a9d00

SHA1
001f71277cf609f6eec734d36b27456a09462189

SHA256
2b749e78508636ffda423f71155cb22172070c6831bc558115afc7171970387f

SHA512
98cff5edbffe7a4ed1d50f6fb5aea8e58556b565ba86ffd0325379278abfc223d7af30c950a7c3818e44c41e7b73fb3cf8a75326134a87a48a59ff17e43ee4a3

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe

Filesize
377KB

MD5
dc10105e9d919c778fd580e970b22515

SHA1
a45367878c87a2ce68b434968b41a25e69d29992

SHA256
0b6fbbe0bc0fc366c58f139a154d027db3c512e0326911611863e266b318a1e0

SHA512
24e37d2bd54418d2c021203eb5226fc2af2b321cdd761b96ed9adc3ca9010baedf17014c520091ec17016905e0b80417356ae0026b42d42ca2ad44de6e1394c1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2903753.exe

Filesize
377KB

MD5
dc10105e9d919c778fd580e970b22515

SHA1
a45367878c87a2ce68b434968b41a25e69d29992

SHA256
0b6fbbe0bc0fc366c58f139a154d027db3c512e0326911611863e266b318a1e0

SHA512
24e37d2bd54418d2c021203eb5226fc2af2b321cdd761b96ed9adc3ca9010baedf17014c520091ec17016905e0b80417356ae0026b42d42ca2ad44de6e1394c1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe

Filesize
206KB

MD5
b3c57d26899a42c3f5bdcad36d1c3590

SHA1
20ebc1e908fbd59e5238bebd78e2d666cdce6863

SHA256
48d245d0ade9a13a6db08fb30bdeeeb3c7f3aa3297d75a61c80b5ceed123e190

SHA512
7f60bca49482216a5840e9cb9f2847177710bf64571e7f91c85c597044a45de9ea036df81e1101bee42c47e91258da6c87b0aae823ce36e5634ca29aa512cc9a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5571242.exe

Filesize
206KB

MD5
b3c57d26899a42c3f5bdcad36d1c3590

SHA1
20ebc1e908fbd59e5238bebd78e2d666cdce6863

SHA256
48d245d0ade9a13a6db08fb30bdeeeb3c7f3aa3297d75a61c80b5ceed123e190

SHA512
7f60bca49482216a5840e9cb9f2847177710bf64571e7f91c85c597044a45de9ea036df81e1101bee42c47e91258da6c87b0aae823ce36e5634ca29aa512cc9a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4929212.exe

Filesize
13KB

MD5
a04f642504a844f671c51f6a3a2207fb

SHA1
44edd5736739f8680b1d1e8f140651d8bebad761

SHA256
d8faf4696d989765ffa45949029d15d7e106c3442f709ec05018dd7fec83355c

SHA512
430854adfa2fd9341126493b3af49c7c186004f84ea914b819a3e15342cd42e888c718444b7d0d01a0903539f013e7e45dabe3d63698907761f2739b728bdfd8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe

Filesize
172KB

MD5
3e1c5d41b6ad6cf7b04027cc7e3a9d00

SHA1
001f71277cf609f6eec734d36b27456a09462189

SHA256
2b749e78508636ffda423f71155cb22172070c6831bc558115afc7171970387f

SHA512
98cff5edbffe7a4ed1d50f6fb5aea8e58556b565ba86ffd0325379278abfc223d7af30c950a7c3818e44c41e7b73fb3cf8a75326134a87a48a59ff17e43ee4a3

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1207517.exe

Filesize
172KB

MD5
3e1c5d41b6ad6cf7b04027cc7e3a9d00

SHA1
001f71277cf609f6eec734d36b27456a09462189

SHA256
2b749e78508636ffda423f71155cb22172070c6831bc558115afc7171970387f

SHA512
98cff5edbffe7a4ed1d50f6fb5aea8e58556b565ba86ffd0325379278abfc223d7af30c950a7c3818e44c41e7b73fb3cf8a75326134a87a48a59ff17e43ee4a3

Download Submit
memory/676-82-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/1344-89-0x0000000000E80000-0x0000000000EB0000-memory.dmp

Filesize
192KB

Download
memory/1344-90-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1344-91-0x0000000000DB0000-0x0000000000DF0000-memory.dmp

Filesize
256KB

Download
memory/1344-92-0x0000000000DB0000-0x0000000000DF0000-memory.dmp

Filesize
256KB

Download