redline | cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe
Size

722KB
MD5

813a4b7101896c7ac66b652eaad4f888
SHA1

68a78bee7a6d3fe2f34f949ab556b586806ff694
SHA256

cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192
SHA512

da382775b5845f409cc2880939d8fea281b7927b60faeb3eb4c5989f192339d24f3fb5721d7b771a7fddd9b25465677b9df341714ec2b5105b56f0b82961dd8e
SSDEEP

12288:kMrZy907WzVqfE8LjawR0vYjgpGyb1Wg9ijinXWRvpL4eGHQGFHxeW:tygWRWjaYqGyxzNEZmHQqHxeW

Score

10^/10

redline dasa discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dasa

83.97.73.126:19048

Attributes

auth_value
7eca6ed540c2dcd359aed5b67c4eda07

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0168294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0168294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0168294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k0168294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0168294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0168294.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
4896	y3370459.exe
1700	y1367283.exe
3660	y0549825.exe
2096	j7977811.exe
228	k0168294.exe
4804	l6585035.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0168294.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y3370459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3370459.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y1367283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1367283.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0549825.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y0549825.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 4552	2096	j7977811.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	2096	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4552	AppLaunch.exe
4552	AppLaunch.exe
228	k0168294.exe
228	k0168294.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe
4804	l6585035.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	AppLaunch.exe
Token: SeDebugPrivilege	228	k0168294.exe
Token: SeDebugPrivilege	4804	l6585035.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4896	1420	cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe	84
PID 1420 wrote to memory of 4896	1420	cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe	84
PID 1420 wrote to memory of 4896	1420	cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe	84
PID 4896 wrote to memory of 1700	4896	y3370459.exe	85
PID 4896 wrote to memory of 1700	4896	y3370459.exe	85
PID 4896 wrote to memory of 1700	4896	y3370459.exe	85
PID 1700 wrote to memory of 3660	1700	y1367283.exe	86
PID 1700 wrote to memory of 3660	1700	y1367283.exe	86
PID 1700 wrote to memory of 3660	1700	y1367283.exe	86
PID 3660 wrote to memory of 2096	3660	y0549825.exe	87
PID 3660 wrote to memory of 2096	3660	y0549825.exe	87
PID 3660 wrote to memory of 2096	3660	y0549825.exe	87
PID 2096 wrote to memory of 4552	2096	j7977811.exe	89
PID 2096 wrote to memory of 4552	2096	j7977811.exe	89
PID 2096 wrote to memory of 4552	2096	j7977811.exe	89
PID 2096 wrote to memory of 4552	2096	j7977811.exe	89
PID 2096 wrote to memory of 4552	2096	j7977811.exe	89
PID 3660 wrote to memory of 228	3660	y0549825.exe	92
PID 3660 wrote to memory of 228	3660	y0549825.exe	92
PID 1700 wrote to memory of 4804	1700	y1367283.exe	93
PID 1700 wrote to memory of 4804	1700	y1367283.exe	93
PID 1700 wrote to memory of 4804	1700	y1367283.exe	93

C:\Users\Admin\AppData\Local\Temp\cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe
"C:\Users\Admin\AppData\Local\Temp\cd826afdb55e07846e823db1f9d0544ac8f9b4d411223ef4b18038c7d9e34192.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3370459.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3370459.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1367283.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1367283.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0549825.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0549825.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7977811.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7977811.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2096
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 560
        6⤵
        Program crash
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k0168294.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k0168294.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6585035.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6585035.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2096 -ip 2096
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3370459.exe

Filesize
523KB

MD5
a2a5adf7d21db762d7ab271283a52b1c

SHA1
65c146665f90a434349563d472fea9212336f5d6

SHA256
0fd7ea5831e7530de3f66d09d11ea28e16a6cd1ab835fc3358883334f7d7097c

SHA512
1b7b97ce6d675fa4359f1cebe1c12c27b838950e5a53ec988263620836f04147028eab5dd75b9a0846926b83e028c9a1b3ebd73f0ab62885ef6ff49ea7fc1689

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3370459.exe

Filesize
523KB

MD5
a2a5adf7d21db762d7ab271283a52b1c

SHA1
65c146665f90a434349563d472fea9212336f5d6

SHA256
0fd7ea5831e7530de3f66d09d11ea28e16a6cd1ab835fc3358883334f7d7097c

SHA512
1b7b97ce6d675fa4359f1cebe1c12c27b838950e5a53ec988263620836f04147028eab5dd75b9a0846926b83e028c9a1b3ebd73f0ab62885ef6ff49ea7fc1689

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1367283.exe

Filesize
351KB

MD5
bf3203919b4aa2b1f174e53bbee26651

SHA1
fac959bfce088172899d307cc7523af836f47a80

SHA256
0c9dd9148d298a0a57eb2f8996f4ec59847d4dbe2040429ce18249c950c565a2

SHA512
72aae3dfbc8a886001647d2b9d68f02a5c2973b03a1a8d4685c7cfa1e984b864c5b42995aa554bbc447c7e9b8d5a19159b1320948d75985fbcd44985f56cbf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1367283.exe

Filesize
351KB

MD5
bf3203919b4aa2b1f174e53bbee26651

SHA1
fac959bfce088172899d307cc7523af836f47a80

SHA256
0c9dd9148d298a0a57eb2f8996f4ec59847d4dbe2040429ce18249c950c565a2

SHA512
72aae3dfbc8a886001647d2b9d68f02a5c2973b03a1a8d4685c7cfa1e984b864c5b42995aa554bbc447c7e9b8d5a19159b1320948d75985fbcd44985f56cbf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6585035.exe

Filesize
172KB

MD5
6705f99d93ebe160aa8f828805cb58b3

SHA1
5e12c9fdb66c494b21fb3bf6fd84fdb351236f15

SHA256
403b13c77443cfdad500f827abe883fe421fd20989a3b349fe77285351782972

SHA512
4ea82672c5bfd91061098f3728d0576c102390ab2734141d44a213638ce2f6b3c058c493efb060e3651703f0920bf538fdd06113cde12552e315022e4dc01f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6585035.exe

Filesize
172KB

MD5
6705f99d93ebe160aa8f828805cb58b3

SHA1
5e12c9fdb66c494b21fb3bf6fd84fdb351236f15

SHA256
403b13c77443cfdad500f827abe883fe421fd20989a3b349fe77285351782972

SHA512
4ea82672c5bfd91061098f3728d0576c102390ab2734141d44a213638ce2f6b3c058c493efb060e3651703f0920bf538fdd06113cde12552e315022e4dc01f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0549825.exe

Filesize
196KB

MD5
b3bfdfc2670032e37747e7831c87959c

SHA1
7b13168955aabf13546a3b0507d50d50d14e2aad

SHA256
622c45ce898cea609cdf0f2023089c0e9791181e6250159fe7b7adff54142489

SHA512
ab5ba2e69d871180bdf77b321ff23c1697ecc3c8831d91d83ca894869add702a6340034eb8d5908703138c0913be4bf8ba640b8dec653e90d95f80c1a7216837

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0549825.exe

Filesize
196KB

MD5
b3bfdfc2670032e37747e7831c87959c

SHA1
7b13168955aabf13546a3b0507d50d50d14e2aad

SHA256
622c45ce898cea609cdf0f2023089c0e9791181e6250159fe7b7adff54142489

SHA512
ab5ba2e69d871180bdf77b321ff23c1697ecc3c8831d91d83ca894869add702a6340034eb8d5908703138c0913be4bf8ba640b8dec653e90d95f80c1a7216837

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7977811.exe

Filesize
100KB

MD5
5e4d019c530ccfedfd447de2ec864f86

SHA1
c5bb96605463e184ae4e6abbe334e3f0fe049a0d

SHA256
fd13d526bf4e52015be00ceb4cdef70ef9f7388f148e83693b0229ed35f30941

SHA512
b3855a69f3b427f882bb98402c06c7f9987ee80fa9d735d6d5741f9afcc93d08bf7bd59699d42db7c760169dca1e965e319e043888cb94e99289a789ea3e9741

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7977811.exe

Filesize
100KB

MD5
5e4d019c530ccfedfd447de2ec864f86

SHA1
c5bb96605463e184ae4e6abbe334e3f0fe049a0d

SHA256
fd13d526bf4e52015be00ceb4cdef70ef9f7388f148e83693b0229ed35f30941

SHA512
b3855a69f3b427f882bb98402c06c7f9987ee80fa9d735d6d5741f9afcc93d08bf7bd59699d42db7c760169dca1e965e319e043888cb94e99289a789ea3e9741

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k0168294.exe

Filesize
11KB

MD5
35148121e93b2903c6ea720f4af0e8fd

SHA1
ff33ed98166a08008b3d3212435c0e3707204229

SHA256
a65380126b5f7615f67af3f925864e43edbee91028aa58cf9783f28a5e7f2071

SHA512
5517fd5c0a0e7685ff93cf12b6fecadf9d3f57bb37a8f7d76e7db0c2914b672c1d9006efd86d081fe1f5b1afdc020a5d476534e15914f58a9b6ebc94fd41be2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k0168294.exe

Filesize
11KB

MD5
35148121e93b2903c6ea720f4af0e8fd

SHA1
ff33ed98166a08008b3d3212435c0e3707204229

SHA256
a65380126b5f7615f67af3f925864e43edbee91028aa58cf9783f28a5e7f2071

SHA512
5517fd5c0a0e7685ff93cf12b6fecadf9d3f57bb37a8f7d76e7db0c2914b672c1d9006efd86d081fe1f5b1afdc020a5d476534e15914f58a9b6ebc94fd41be2b

Download Submit
memory/228-170-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/4552-162-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4804-176-0x00000000008F0000-0x0000000000920000-memory.dmp

Filesize
192KB

Download
memory/4804-177-0x0000000005930000-0x0000000005F48000-memory.dmp

Filesize
6.1MB

Download
memory/4804-178-0x0000000005450000-0x000000000555A000-memory.dmp

Filesize
1.0MB

Download
memory/4804-179-0x0000000005390000-0x00000000053A2000-memory.dmp

Filesize
72KB

Download
memory/4804-180-0x00000000053F0000-0x000000000542C000-memory.dmp

Filesize
240KB

Download
memory/4804-181-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/4804-182-0x0000000005700000-0x0000000005776000-memory.dmp

Filesize
472KB

Download
memory/4804-183-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/4804-184-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/4804-185-0x0000000006AF0000-0x0000000007094000-memory.dmp

Filesize
5.6MB

Download
memory/4804-186-0x00000000068D0000-0x0000000006A92000-memory.dmp

Filesize
1.8MB

Download
memory/4804-187-0x0000000008AC0000-0x0000000008FEC000-memory.dmp

Filesize
5.2MB

Download
memory/4804-188-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/4804-189-0x0000000006800000-0x0000000006850000-memory.dmp

Filesize
320KB

Download