redline | beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe
Size

739KB
MD5

ea64b99e2ce9169bd1ab65e16cf7a5b4
SHA1

2f30cb4adbd4b8a68a54548d79d2f81d28182789
SHA256

beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348
SHA512

cf528ffcc866b8dce882107051c92796b86c8ed2bde05e1c8a615959315c90150557f867a404d4be252ef1ed34654b147e636b3720b647f655529b4330711b84
SSDEEP

12288:5MrSy90EqwwwGJBJyFhOTywv17WUtggeS3c1KyWgNbtXGm0N2eX:LyFqskyF2/oyg3wyWubtXN0weX

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a6559582.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6559582.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v2170934.exev2943011.exev6714197.exea6559582.exeb4074314.exec6131931.exe

pid process

4520 v2170934.exe
3932 v2943011.exe
1252 v6714197.exe
4324 a6559582.exe
1116 b4074314.exe
208 c6131931.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a6559582.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6559582.exe

pid	process
4520	v2170934.exe
3932	v2943011.exe
1252	v6714197.exe
4324	a6559582.exe
1116	b4074314.exe
208	c6131931.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6559582.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v6714197.exebeeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exev2170934.exev2943011.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6714197.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v6714197.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2170934.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2170934.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2943011.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2943011.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4074314.exe

description pid process target process

PID 1116 set thread context of 3960 1116 b4074314.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4320 1116 WerFault.exe b4074314.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a6559582.exeAppLaunch.exe

pid process

4324 a6559582.exe
4324 a6559582.exe
3960 AppLaunch.exe
3960 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a6559582.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 4324 a6559582.exe
Token: SeDebugPrivilege 3960 AppLaunch.exe

description	pid	process	target process
PID 1116 set thread context of 3960	1116	b4074314.exe	AppLaunch.exe

pid	pid_target	process	target process
4320	1116	WerFault.exe	b4074314.exe

pid	process
4324	a6559582.exe
4324	a6559582.exe
3960	AppLaunch.exe
3960	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4324	a6559582.exe
Token: SeDebugPrivilege	3960	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exev2170934.exev2943011.exev6714197.exeb4074314.exe

description	pid	process	target process
PID 4904 wrote to memory of 4520	4904	beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe	v2170934.exe
PID 4904 wrote to memory of 4520	4904	beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe	v2170934.exe
PID 4904 wrote to memory of 4520	4904	beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe	v2170934.exe
PID 4520 wrote to memory of 3932	4520	v2170934.exe	v2943011.exe
PID 4520 wrote to memory of 3932	4520	v2170934.exe	v2943011.exe
PID 4520 wrote to memory of 3932	4520	v2170934.exe	v2943011.exe
PID 3932 wrote to memory of 1252	3932	v2943011.exe	v6714197.exe
PID 3932 wrote to memory of 1252	3932	v2943011.exe	v6714197.exe
PID 3932 wrote to memory of 1252	3932	v2943011.exe	v6714197.exe
PID 1252 wrote to memory of 4324	1252	v6714197.exe	a6559582.exe
PID 1252 wrote to memory of 4324	1252	v6714197.exe	a6559582.exe
PID 1252 wrote to memory of 1116	1252	v6714197.exe	b4074314.exe
PID 1252 wrote to memory of 1116	1252	v6714197.exe	b4074314.exe
PID 1252 wrote to memory of 1116	1252	v6714197.exe	b4074314.exe
PID 1116 wrote to memory of 3960	1116	b4074314.exe	AppLaunch.exe
PID 1116 wrote to memory of 3960	1116	b4074314.exe	AppLaunch.exe
PID 1116 wrote to memory of 3960	1116	b4074314.exe	AppLaunch.exe
PID 1116 wrote to memory of 3960	1116	b4074314.exe	AppLaunch.exe
PID 1116 wrote to memory of 3960	1116	b4074314.exe	AppLaunch.exe
PID 3932 wrote to memory of 208	3932	v2943011.exe	c6131931.exe
PID 3932 wrote to memory of 208	3932	v2943011.exe	c6131931.exe
PID 3932 wrote to memory of 208	3932	v2943011.exe	c6131931.exe

C:\Users\Admin\AppData\Local\Temp\beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe
"C:\Users\Admin\AppData\Local\Temp\beeefbaf87551a3b824af0ab3074943f7782c7566a415969f8cd80c1d6b24348.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2170934.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2170934.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2943011.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2943011.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3932

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6714197.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6714197.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6559582.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6559582.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4074314.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4074314.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 152
6⤵
- Program crash
PID:4320

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6131931.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6131931.exe
4⤵
- Executes dropped EXE
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1116 -ip 1116
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2170934.exe
Filesize
532KB

MD5
368bdc75ada400eeaf897186dd8584a5

SHA1
22a9a7726c6043449aaf4637b470475f9a07e787

SHA256
14318189122bf0b2fa2b0cebd2b939c79cbbd6fa69e2f3834802fb3accb2b24c

SHA512
4f0d1f775afb60e4b445531634dd47a86ea548d4076e25e11ab469d33dbdab65c91eee54d262dee45f14bb116e23a2a381ae9bc14d978efcf12f4b256e6ae492

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2170934.exe
Filesize
532KB

MD5
368bdc75ada400eeaf897186dd8584a5

SHA1
22a9a7726c6043449aaf4637b470475f9a07e787

SHA256
14318189122bf0b2fa2b0cebd2b939c79cbbd6fa69e2f3834802fb3accb2b24c

SHA512
4f0d1f775afb60e4b445531634dd47a86ea548d4076e25e11ab469d33dbdab65c91eee54d262dee45f14bb116e23a2a381ae9bc14d978efcf12f4b256e6ae492

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2943011.exe
Filesize
359KB

MD5
088edc7b50aec736aee5e6a13ee55845

SHA1
f21130c7698796e9b36bb83377e33ecf3f35031d

SHA256
7f14eb66ad545c150ed87e1e5d48198045f1189765f65ec4bdb33d4237ca6483

SHA512
13e6562d8d4e23a9113caa4a742a34bf2ffa750042035cf7f37dc852543438c557871c7b6e173d8ac9e09a718c82df31e33e6e383f63164c2d04e3e10d5d5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2943011.exe
Filesize
359KB

MD5
088edc7b50aec736aee5e6a13ee55845

SHA1
f21130c7698796e9b36bb83377e33ecf3f35031d

SHA256
7f14eb66ad545c150ed87e1e5d48198045f1189765f65ec4bdb33d4237ca6483

SHA512
13e6562d8d4e23a9113caa4a742a34bf2ffa750042035cf7f37dc852543438c557871c7b6e173d8ac9e09a718c82df31e33e6e383f63164c2d04e3e10d5d5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6131931.exe
Filesize
172KB

MD5
62b26fa14fe7a5b1d074a7fd362a9b20

SHA1
20c6cdee6c1fc5f0c9283e52d5f837c3fcb14d60

SHA256
926a75b7aa6ede1606218486049c39f8689519fe655fd36f8e58c21cd0df00f8

SHA512
28dd5629d8e119ad7dea1632dbe717c081165a578cc7e1189cf6285e754582599579c336fb5eab4112d17ea3910617d36a0763b616ce1d6cb4ecadf744de09df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6131931.exe
Filesize
172KB

MD5
62b26fa14fe7a5b1d074a7fd362a9b20

SHA1
20c6cdee6c1fc5f0c9283e52d5f837c3fcb14d60

SHA256
926a75b7aa6ede1606218486049c39f8689519fe655fd36f8e58c21cd0df00f8

SHA512
28dd5629d8e119ad7dea1632dbe717c081165a578cc7e1189cf6285e754582599579c336fb5eab4112d17ea3910617d36a0763b616ce1d6cb4ecadf744de09df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6714197.exe
Filesize
204KB

MD5
9baf9f0937497b51daf27a005cda3637

SHA1
4adcfdd8431080c08e63ed77380846a206b64b19

SHA256
4d3a25537fea3192183547dfade969a1561a082349be64d563c740efb4a1b8ce

SHA512
d4094ae46b8c2f50ef5717b93f43e3f9f18b103996076e1ca6319527d0b35234712d3859069e7c5b7f57720f8aae36265fe03b2a98e783fd3c754eb4e3cc1a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6714197.exe
Filesize
204KB

MD5
9baf9f0937497b51daf27a005cda3637

SHA1
4adcfdd8431080c08e63ed77380846a206b64b19

SHA256
4d3a25537fea3192183547dfade969a1561a082349be64d563c740efb4a1b8ce

SHA512
d4094ae46b8c2f50ef5717b93f43e3f9f18b103996076e1ca6319527d0b35234712d3859069e7c5b7f57720f8aae36265fe03b2a98e783fd3c754eb4e3cc1a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6559582.exe
Filesize
14KB

MD5
8536946211b72dc37108984d92b61ca9

SHA1
01f10bd81d7fb191304913c306117e499b1f9a21

SHA256
17fe6cad41b76375bcebbe67ed8ad4a7def18c2a67aadf0f63288364fefc9567

SHA512
ac6a13e8f17c1f0bd52d38cc279ce232e6a07f6d1c123f95c32c21953e3e22ecfc199ed8786c1c394d910706387ebabd84289253f914528a1688c15fadb2b321

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6559582.exe
Filesize
14KB

MD5
8536946211b72dc37108984d92b61ca9

SHA1
01f10bd81d7fb191304913c306117e499b1f9a21

SHA256
17fe6cad41b76375bcebbe67ed8ad4a7def18c2a67aadf0f63288364fefc9567

SHA512
ac6a13e8f17c1f0bd52d38cc279ce232e6a07f6d1c123f95c32c21953e3e22ecfc199ed8786c1c394d910706387ebabd84289253f914528a1688c15fadb2b321

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4074314.exe
Filesize
120KB

MD5
3201bae60ee67ae00995e65d855d5b90

SHA1
2f019c85a9f9282023d2ef01a3888400a7adcdfc

SHA256
a0d33c15029f4edd1c134bef1e52427bc4cea936059c1cf11e4cdf76dfb245dc

SHA512
54f2733f2d53d9a38fc8aa59c5691025915ac5e0864d51b0a75fbd5e1699065a6f49ec68c944f303bb545e36cf1e26ce19690208608a98b045f39a91ff2a1b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4074314.exe
Filesize
120KB

MD5
3201bae60ee67ae00995e65d855d5b90

SHA1
2f019c85a9f9282023d2ef01a3888400a7adcdfc

SHA256
a0d33c15029f4edd1c134bef1e52427bc4cea936059c1cf11e4cdf76dfb245dc

SHA512
54f2733f2d53d9a38fc8aa59c5691025915ac5e0864d51b0a75fbd5e1699065a6f49ec68c944f303bb545e36cf1e26ce19690208608a98b045f39a91ff2a1b15

Download Submit
memory/208-175-0x00000000002D0000-0x0000000000300000-memory.dmp

Filesize
192KB

Download
memory/208-176-0x000000000A5E0000-0x000000000ABF8000-memory.dmp

Filesize
6.1MB

Download
memory/208-177-0x000000000A110000-0x000000000A21A000-memory.dmp

Filesize
1.0MB

Download
memory/208-178-0x000000000A050000-0x000000000A062000-memory.dmp

Filesize
72KB

Download
memory/208-179-0x000000000A0B0000-0x000000000A0EC000-memory.dmp

Filesize
240KB

Download
memory/208-180-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/208-182-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/3960-167-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4324-161-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download