redline | 65141035941017854ad4ac7a2ad9ff6e553da933a2311843f2144366946a2796

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06874999.exe
Size

739KB
MD5

302b0f6d712eba3d1a0b8ebf8dc98aec
SHA1

6c564fafa65f2ab0b6bd5ea791cac254ab7cf331
SHA256

65141035941017854ad4ac7a2ad9ff6e553da933a2311843f2144366946a2796
SHA512

4d1e5352ecf82540e3ee2b065bb3ca32b1bac2d5291eeb94a8d896b89369b86b09f68943fde2ca6ac50aac2d629bfd8b74f5565c790d7834f2e53368fff634c6
SSDEEP

12288:IMrWy90kbJ6cC+DS6NYfJBBHjUmHzf7J3NPS/qygFBreKIvBCJW5yoQP:eyNJTDSdPbN3NPGqyyBrkIJIyvP

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exea3031433.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3031433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3031433.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3031433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3031433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3031433.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3031433.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v7531338.exev9263717.exev5183631.exea3031433.exeb3728369.exec3276124.exe

pid process

1188 v7531338.exe
1160 v9263717.exe
2800 v5183631.exe
1368 a3031433.exe
212 b3728369.exe
460 c3276124.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a3031433.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3031433.exe

pid	process
1188	v7531338.exe
1160	v9263717.exe
2800	v5183631.exe
1368	a3031433.exe
212	b3728369.exe
460	c3276124.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3031433.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v7531338.exev9263717.exev5183631.exe06874999.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v7531338.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7531338.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9263717.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9263717.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5183631.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5183631.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	06874999.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	06874999.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3728369.exe

description pid process target process

PID 212 set thread context of 5044 212 b3728369.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2632 212 WerFault.exe b3728369.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a3031433.exeAppLaunch.exe

pid process

1368 a3031433.exe
1368 a3031433.exe
5044 AppLaunch.exe
5044 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3031433.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 1368 a3031433.exe
Token: SeDebugPrivilege 5044 AppLaunch.exe

description	pid	process	target process
PID 212 set thread context of 5044	212	b3728369.exe	AppLaunch.exe

pid	pid_target	process	target process
2632	212	WerFault.exe	b3728369.exe

pid	process
1368	a3031433.exe
1368	a3031433.exe
5044	AppLaunch.exe
5044	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1368	a3031433.exe
Token: SeDebugPrivilege	5044	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

06874999.exev7531338.exev9263717.exev5183631.exeb3728369.exe

description	pid	process	target process
PID 444 wrote to memory of 1188	444	06874999.exe	v7531338.exe
PID 444 wrote to memory of 1188	444	06874999.exe	v7531338.exe
PID 444 wrote to memory of 1188	444	06874999.exe	v7531338.exe
PID 1188 wrote to memory of 1160	1188	v7531338.exe	v9263717.exe
PID 1188 wrote to memory of 1160	1188	v7531338.exe	v9263717.exe
PID 1188 wrote to memory of 1160	1188	v7531338.exe	v9263717.exe
PID 1160 wrote to memory of 2800	1160	v9263717.exe	v5183631.exe
PID 1160 wrote to memory of 2800	1160	v9263717.exe	v5183631.exe
PID 1160 wrote to memory of 2800	1160	v9263717.exe	v5183631.exe
PID 2800 wrote to memory of 1368	2800	v5183631.exe	a3031433.exe
PID 2800 wrote to memory of 1368	2800	v5183631.exe	a3031433.exe
PID 2800 wrote to memory of 212	2800	v5183631.exe	b3728369.exe
PID 2800 wrote to memory of 212	2800	v5183631.exe	b3728369.exe
PID 2800 wrote to memory of 212	2800	v5183631.exe	b3728369.exe
PID 212 wrote to memory of 5044	212	b3728369.exe	AppLaunch.exe
PID 212 wrote to memory of 5044	212	b3728369.exe	AppLaunch.exe
PID 212 wrote to memory of 5044	212	b3728369.exe	AppLaunch.exe
PID 212 wrote to memory of 5044	212	b3728369.exe	AppLaunch.exe
PID 212 wrote to memory of 5044	212	b3728369.exe	AppLaunch.exe
PID 1160 wrote to memory of 460	1160	v9263717.exe	c3276124.exe
PID 1160 wrote to memory of 460	1160	v9263717.exe	c3276124.exe
PID 1160 wrote to memory of 460	1160	v9263717.exe	c3276124.exe

C:\Users\Admin\AppData\Local\Temp\06874999.exe
"C:\Users\Admin\AppData\Local\Temp\06874999.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:444

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7531338.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7531338.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263717.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263717.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5183631.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5183631.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3031433.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3031433.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3728369.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3728369.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 220
6⤵
- Program crash
PID:2632

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3276124.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3276124.exe
4⤵
- Executes dropped EXE
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 212 -ip 212
1⤵
PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7531338.exe
Filesize
532KB

MD5
9f3cba9132e818f87b82bfd1dec1ef44

SHA1
a62c86a3a16263279074a6646cfcfc2778b89899

SHA256
27ea521651300c184d2c57a793e81301b1324b4917981bacbc61e17352a6365f

SHA512
be66a8c534a2ef754c0ceda136abc54d74453cf7ee7ad8918c46ba62fa7617c2ebfe88f8022f6e2aacd32cd632164b688218fb3b1172b7e991e237e17a47de3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7531338.exe
Filesize
532KB

MD5
9f3cba9132e818f87b82bfd1dec1ef44

SHA1
a62c86a3a16263279074a6646cfcfc2778b89899

SHA256
27ea521651300c184d2c57a793e81301b1324b4917981bacbc61e17352a6365f

SHA512
be66a8c534a2ef754c0ceda136abc54d74453cf7ee7ad8918c46ba62fa7617c2ebfe88f8022f6e2aacd32cd632164b688218fb3b1172b7e991e237e17a47de3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263717.exe
Filesize
359KB

MD5
8ddd700c9c58bcbd61948ece8102ce15

SHA1
60d9e88620ad374384020bd11a3e23db380e2981

SHA256
33c336e8ba629bcc31057daba0ae8c010e73d559a9209792833ef49213507560

SHA512
8b95247a00a9621a794d86f8be57208acc6447bb1ab86d3c1c51d55f2e130da8130984aac7f6640fb45f4f3500091f7d2ad76874c3c37296ba6c8956ff6bd48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263717.exe
Filesize
359KB

MD5
8ddd700c9c58bcbd61948ece8102ce15

SHA1
60d9e88620ad374384020bd11a3e23db380e2981

SHA256
33c336e8ba629bcc31057daba0ae8c010e73d559a9209792833ef49213507560

SHA512
8b95247a00a9621a794d86f8be57208acc6447bb1ab86d3c1c51d55f2e130da8130984aac7f6640fb45f4f3500091f7d2ad76874c3c37296ba6c8956ff6bd48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3276124.exe
Filesize
172KB

MD5
7c412cfbd52a7cdc085f22d008303140

SHA1
97b64b26e4ae34360f4642b823e1a2d66d3be7d7

SHA256
0adfdaf7ffac50f3e5bfebe95f1a33552447ca7d800080f767f9b3b8d1780135

SHA512
84f4b21f1df6cef5b39ca541af4a5615d8e9d6ef2749454a04fd65cdfd9b2179697417987cdc57584611405505fb54dd64a632f23108d0bb664b13ed67e6cb22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3276124.exe
Filesize
172KB

MD5
7c412cfbd52a7cdc085f22d008303140

SHA1
97b64b26e4ae34360f4642b823e1a2d66d3be7d7

SHA256
0adfdaf7ffac50f3e5bfebe95f1a33552447ca7d800080f767f9b3b8d1780135

SHA512
84f4b21f1df6cef5b39ca541af4a5615d8e9d6ef2749454a04fd65cdfd9b2179697417987cdc57584611405505fb54dd64a632f23108d0bb664b13ed67e6cb22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5183631.exe
Filesize
204KB

MD5
025ea76ef219cf2e4595af6f23a0e034

SHA1
f3a77c3bb4fb22b3412b798351e73ef9190d3578

SHA256
c54ddd3e51f87225c221176cc14df29777e6d17d59e8cc024ccdffced861ae13

SHA512
91c697dcec32c107bec0b5b97c6e2b8c998fed38aa74dc446d131eabc4b9e7fa009fc75eca257d00937dd42727b348de0a8626f4dae79ea0a3cf4cb904f9a432

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5183631.exe
Filesize
204KB

MD5
025ea76ef219cf2e4595af6f23a0e034

SHA1
f3a77c3bb4fb22b3412b798351e73ef9190d3578

SHA256
c54ddd3e51f87225c221176cc14df29777e6d17d59e8cc024ccdffced861ae13

SHA512
91c697dcec32c107bec0b5b97c6e2b8c998fed38aa74dc446d131eabc4b9e7fa009fc75eca257d00937dd42727b348de0a8626f4dae79ea0a3cf4cb904f9a432

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3031433.exe
Filesize
13KB

MD5
b98df5064ab62453b88540430ad97abe

SHA1
5c5dea6c3ca46227479d50917e155d13d4564c27

SHA256
d487ea328b6c6a98a959bca8ebeaac10cea1ff9b202a1448d09be034cd328664

SHA512
e4bafc90cf556acd3edb994ee9bf578a771d6c13e81cf9935dfff3201e897ab968caf9ddb230229d595d65df1b4f10d3076b4be13ecd4b7af62d6f0c11cb3dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3031433.exe
Filesize
13KB

MD5
b98df5064ab62453b88540430ad97abe

SHA1
5c5dea6c3ca46227479d50917e155d13d4564c27

SHA256
d487ea328b6c6a98a959bca8ebeaac10cea1ff9b202a1448d09be034cd328664

SHA512
e4bafc90cf556acd3edb994ee9bf578a771d6c13e81cf9935dfff3201e897ab968caf9ddb230229d595d65df1b4f10d3076b4be13ecd4b7af62d6f0c11cb3dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3728369.exe
Filesize
120KB

MD5
bb3d19feded6b3f3b78efdec80fc3aba

SHA1
b115c21e2304ae26d0f56917fa798d7bf784ba24

SHA256
61310e75dcf5e3c0975ce16622d4f0568e32fa9fd45ae3e49d7e9f27498ab547

SHA512
9b7f76c158e9f24c34e8cbaff7ee1a0a647b3cde59e341f055cb9238e1947cfcaeb19596957fa9544ab0988614a50b77f62ebc689d7281f543ab84bde517c69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3728369.exe
Filesize
120KB

MD5
bb3d19feded6b3f3b78efdec80fc3aba

SHA1
b115c21e2304ae26d0f56917fa798d7bf784ba24

SHA256
61310e75dcf5e3c0975ce16622d4f0568e32fa9fd45ae3e49d7e9f27498ab547

SHA512
9b7f76c158e9f24c34e8cbaff7ee1a0a647b3cde59e341f055cb9238e1947cfcaeb19596957fa9544ab0988614a50b77f62ebc689d7281f543ab84bde517c69b

Download Submit
memory/460-175-0x0000000000910000-0x0000000000940000-memory.dmp

Filesize
192KB

Download
memory/460-176-0x000000000ABD0000-0x000000000B1E8000-memory.dmp

Filesize
6.1MB

Download
memory/460-177-0x000000000A750000-0x000000000A85A000-memory.dmp

Filesize
1.0MB

Download
memory/460-178-0x000000000A690000-0x000000000A6A2000-memory.dmp

Filesize
72KB

Download
memory/460-179-0x000000000A6F0000-0x000000000A72C000-memory.dmp

Filesize
240KB

Download
memory/460-180-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/460-182-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/1368-161-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/5044-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download