redline | c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe
Size

738KB
MD5

7e9212d562e08f1f158ad8b055db436e
SHA1

8374389d1905e35d47471655fc69939f0b64e917
SHA256

c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c
SHA512

5df7ab4a219afcef7717bdb4036ab3c266029fbcea1a5a3dd8e0d09957376353727364226d628833e7bb9b1ccb0d215bbc70336b28f854879eaa576cd02a70f8
SSDEEP

12288:GMr0y90TiLEzcvhZXT+eojKEgY2h7bFQCgP+fUazH17G/yCp3Cg2pYpo/:iyYMhFy9jmxjgn61PCUgJo/

Score

10^/10

redline diza discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4710644.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4710644.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k4710644.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4710644.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4710644.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4710644.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
2220	y0213544.exe
1860	y8880234.exe
3268	y0177999.exe
1524	j8469618.exe
348	k4710644.exe
1648	l2134191.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4710644.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y0177999.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0213544.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0213544.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8880234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8880234.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0177999.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 884	1524	j8469618.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	1524	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
884	AppLaunch.exe
884	AppLaunch.exe
348	k4710644.exe
348	k4710644.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe
1648	l2134191.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	AppLaunch.exe
Token: SeDebugPrivilege	348	k4710644.exe
Token: SeDebugPrivilege	1648	l2134191.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 2220	3756	c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe	83
PID 3756 wrote to memory of 2220	3756	c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe	83
PID 3756 wrote to memory of 2220	3756	c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe	83
PID 2220 wrote to memory of 1860	2220	y0213544.exe	84
PID 2220 wrote to memory of 1860	2220	y0213544.exe	84
PID 2220 wrote to memory of 1860	2220	y0213544.exe	84
PID 1860 wrote to memory of 3268	1860	y8880234.exe	85
PID 1860 wrote to memory of 3268	1860	y8880234.exe	85
PID 1860 wrote to memory of 3268	1860	y8880234.exe	85
PID 3268 wrote to memory of 1524	3268	y0177999.exe	86
PID 3268 wrote to memory of 1524	3268	y0177999.exe	86
PID 3268 wrote to memory of 1524	3268	y0177999.exe	86
PID 1524 wrote to memory of 884	1524	j8469618.exe	88
PID 1524 wrote to memory of 884	1524	j8469618.exe	88
PID 1524 wrote to memory of 884	1524	j8469618.exe	88
PID 1524 wrote to memory of 884	1524	j8469618.exe	88
PID 1524 wrote to memory of 884	1524	j8469618.exe	88
PID 3268 wrote to memory of 348	3268	y0177999.exe	91
PID 3268 wrote to memory of 348	3268	y0177999.exe	91
PID 1860 wrote to memory of 1648	1860	y8880234.exe	92
PID 1860 wrote to memory of 1648	1860	y8880234.exe	92
PID 1860 wrote to memory of 1648	1860	y8880234.exe	92

C:\Users\Admin\AppData\Local\Temp\c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe
"C:\Users\Admin\AppData\Local\Temp\c9a29715505fda456fbe304ef08e5365661ec086430183970de5cec6138e392c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0213544.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0213544.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8880234.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8880234.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0177999.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0177999.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j8469618.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j8469618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 572
        6⤵
        Program crash
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k4710644.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k4710644.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2134191.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2134191.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1524 -ip 1524
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0213544.exe

Filesize
531KB

MD5
29f6d8887ee63cc3f020612a8d256734

SHA1
a5f04729b3214b3bad48a0b374eb89bc0bea7d33

SHA256
69624c0dba8b2ee95475cd7b0ce16282b2e92546d9e3e2938fe81ede47141fbb

SHA512
821dfd34b7029104c77651f98601270358157a87c8e3491b1804b37d2ef9fafd694cdb096d345328bb681c8577df3e4b48732826a3673ebd372063be2959ffe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0213544.exe

Filesize
531KB

MD5
29f6d8887ee63cc3f020612a8d256734

SHA1
a5f04729b3214b3bad48a0b374eb89bc0bea7d33

SHA256
69624c0dba8b2ee95475cd7b0ce16282b2e92546d9e3e2938fe81ede47141fbb

SHA512
821dfd34b7029104c77651f98601270358157a87c8e3491b1804b37d2ef9fafd694cdb096d345328bb681c8577df3e4b48732826a3673ebd372063be2959ffe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8880234.exe

Filesize
358KB

MD5
30b8d9f7bd7d1347eaf782b841fd5b2a

SHA1
f41dba6b92e1e3f668ca9208e4d5c276f89a72a1

SHA256
85f4befb7723cc8be90b52d61934bec6d4b16dfff81eaa40fa01f1032faf1bb7

SHA512
1f2e9d083bf96c75a14d738ffdccadd114461da1c47959cd4ecfec7d0edd2cc31bf78bee6741b3f0da3c0b0ecd54981da42536c994fcd57c6a937a2a7446e0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8880234.exe

Filesize
358KB

MD5
30b8d9f7bd7d1347eaf782b841fd5b2a

SHA1
f41dba6b92e1e3f668ca9208e4d5c276f89a72a1

SHA256
85f4befb7723cc8be90b52d61934bec6d4b16dfff81eaa40fa01f1032faf1bb7

SHA512
1f2e9d083bf96c75a14d738ffdccadd114461da1c47959cd4ecfec7d0edd2cc31bf78bee6741b3f0da3c0b0ecd54981da42536c994fcd57c6a937a2a7446e0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2134191.exe

Filesize
172KB

MD5
351db03a25ba346a6cb3f4758483f3c0

SHA1
4ce731837eb34034604aa5ecf953deb545500bca

SHA256
4e933c703b321f57349b6c0a9bcda29db9005df614be1b7092338ceff5cad555

SHA512
911c01b4079dadd1d80b8f691f7ec16a7fbe16efc994efa61369877c85aab49abf7f98e2ab0dc447ef444a0bf2f380b682ebf45b5827fbe95858e9539a2fd426

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2134191.exe

Filesize
172KB

MD5
351db03a25ba346a6cb3f4758483f3c0

SHA1
4ce731837eb34034604aa5ecf953deb545500bca

SHA256
4e933c703b321f57349b6c0a9bcda29db9005df614be1b7092338ceff5cad555

SHA512
911c01b4079dadd1d80b8f691f7ec16a7fbe16efc994efa61369877c85aab49abf7f98e2ab0dc447ef444a0bf2f380b682ebf45b5827fbe95858e9539a2fd426

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0177999.exe

Filesize
203KB

MD5
bcfa909552fccfac585f0d8c7db84c90

SHA1
92ae0347b0a7c9f4d4d36968da1bc37b7ebe5dc6

SHA256
873015f8c221a558797a3aefc015fd93779ca10898e777065b3b582338f9be6e

SHA512
80c218d738be1ba9520501ad1f52551b881bb15db236e54c2ca406a7e9f647768204239791313a568ec64a981b60aa09d48b6759d4bb8be09bd87c34b8b5c442

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0177999.exe

Filesize
203KB

MD5
bcfa909552fccfac585f0d8c7db84c90

SHA1
92ae0347b0a7c9f4d4d36968da1bc37b7ebe5dc6

SHA256
873015f8c221a558797a3aefc015fd93779ca10898e777065b3b582338f9be6e

SHA512
80c218d738be1ba9520501ad1f52551b881bb15db236e54c2ca406a7e9f647768204239791313a568ec64a981b60aa09d48b6759d4bb8be09bd87c34b8b5c442

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j8469618.exe

Filesize
120KB

MD5
7100b703a5cd996d891edbba88738b55

SHA1
1edf2fa748d47e55c13c8d749ca072e4d9a9b2bd

SHA256
aeaeb00d7f1631f1bc8b25f5ea6db48c072a9caf08b0ce6b8b5cc471f2b033a5

SHA512
9394b213eb95b1b617ed7ed4f8ebc4cac049e89764aa901ef70ddd611a8540be21a96b7d4ddecbed56c8347ebe30716abf4d82afed59a2041bf4b4353bd10745

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j8469618.exe

Filesize
120KB

MD5
7100b703a5cd996d891edbba88738b55

SHA1
1edf2fa748d47e55c13c8d749ca072e4d9a9b2bd

SHA256
aeaeb00d7f1631f1bc8b25f5ea6db48c072a9caf08b0ce6b8b5cc471f2b033a5

SHA512
9394b213eb95b1b617ed7ed4f8ebc4cac049e89764aa901ef70ddd611a8540be21a96b7d4ddecbed56c8347ebe30716abf4d82afed59a2041bf4b4353bd10745

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k4710644.exe

Filesize
14KB

MD5
0a7d25ff6d6e8b46459c110fbb538a6c

SHA1
a79d834f7fc66f78abc36e88e5565cf59b4a6a27

SHA256
7606c8f851fe8812151452bc8c1a9cab660a5c16a15b71035d9089cbe6d404fa

SHA512
7d970b69c9ff3d40d002feab92a5fe9cca352793fdc7bd74994a56dd3a755f49ae0a416d041852d0778553e02fc7c4c5023af8c75d497b97886c4196d91df71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k4710644.exe

Filesize
14KB

MD5
0a7d25ff6d6e8b46459c110fbb538a6c

SHA1
a79d834f7fc66f78abc36e88e5565cf59b4a6a27

SHA256
7606c8f851fe8812151452bc8c1a9cab660a5c16a15b71035d9089cbe6d404fa

SHA512
7d970b69c9ff3d40d002feab92a5fe9cca352793fdc7bd74994a56dd3a755f49ae0a416d041852d0778553e02fc7c4c5023af8c75d497b97886c4196d91df71c

Download Submit
memory/348-170-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/884-162-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1648-176-0x00000000009F0000-0x0000000000A20000-memory.dmp

Filesize
192KB

Download
memory/1648-177-0x000000000ACB0000-0x000000000B2C8000-memory.dmp

Filesize
6.1MB

Download
memory/1648-178-0x000000000A830000-0x000000000A93A000-memory.dmp

Filesize
1.0MB

Download
memory/1648-179-0x000000000A770000-0x000000000A782000-memory.dmp

Filesize
72KB

Download
memory/1648-180-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/1648-181-0x000000000A7D0000-0x000000000A80C000-memory.dmp

Filesize
240KB

Download
memory/1648-182-0x000000000AAE0000-0x000000000AB56000-memory.dmp

Filesize
472KB

Download
memory/1648-183-0x000000000AC00000-0x000000000AC92000-memory.dmp

Filesize
584KB

Download
memory/1648-184-0x000000000AB60000-0x000000000ABC6000-memory.dmp

Filesize
408KB

Download
memory/1648-185-0x000000000BCC0000-0x000000000C264000-memory.dmp

Filesize
5.6MB

Download
memory/1648-186-0x000000000B7F0000-0x000000000B840000-memory.dmp

Filesize
320KB

Download
memory/1648-187-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/1648-188-0x000000000C270000-0x000000000C432000-memory.dmp

Filesize
1.8MB

Download
memory/1648-189-0x000000000C970000-0x000000000CE9C000-memory.dmp

Filesize
5.2MB

Download