redline | 56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe
Size

752KB
MD5

45f56db7f5e5f8832d5984fc49d4185a
SHA1

0a881cbcb85e923bd492902b29a6a6fd70bae76a
SHA256

56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad
SHA512

f7fb9355bb78732a659cb4171ef1df2808a875f79eda621cfaeb3778e7822572fa393e20dc88fdbc00b08ca9e0e1cc1e40734f2536840c6e789cdc04eca50c67
SSDEEP

12288:DMrVy90h3Hfm6OBvO2BA/EbBOzmx5juEOCNfkLAOkhBqf1sw4DrA:Kyo3HfmjdOrmeEOIfSlknqf1rGA

Score

10^/10

redline diza evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.129:19068

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

k3358457.exeAppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3358457.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3358457.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3358457.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k3358457.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3358457.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3358457.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe	family_redline
behavioral1/memory/3964-175-0x0000000000130000-0x0000000000160000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

y7815613.exey2813514.exey2004158.exej0025530.exek3358457.exel5323032.exe

pid process

2884 y7815613.exe
1564 y2813514.exe
4184 y2004158.exe
3208 j0025530.exe
4480 k3358457.exe
3964 l5323032.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

k3358457.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k3358457.exe

pid	process
2884	y7815613.exe
1564	y2813514.exe
4184	y2004158.exe
3208	j0025530.exe
4480	k3358457.exe
3964	l5323032.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3358457.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exey7815613.exey2813514.exey2004158.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y7815613.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7815613.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2813514.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y2813514.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2004158.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y2004158.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

j0025530.exe

description pid process target process

PID 3208 set thread context of 4664 3208 j0025530.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4564 3208 WerFault.exe j0025530.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AppLaunch.exek3358457.exe

pid process

4664 AppLaunch.exe
4664 AppLaunch.exe
4480 k3358457.exe
4480 k3358457.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AppLaunch.exek3358457.exe

description pid process

Token: SeDebugPrivilege 4664 AppLaunch.exe
Token: SeDebugPrivilege 4480 k3358457.exe

description	pid	process	target process
PID 3208 set thread context of 4664	3208	j0025530.exe	AppLaunch.exe

pid	pid_target	process	target process
4564	3208	WerFault.exe	j0025530.exe

pid	process
4664	AppLaunch.exe
4664	AppLaunch.exe
4480	k3358457.exe
4480	k3358457.exe

description	pid	process
Token: SeDebugPrivilege	4664	AppLaunch.exe
Token: SeDebugPrivilege	4480	k3358457.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exey7815613.exey2813514.exey2004158.exej0025530.exe

description	pid	process	target process
PID 4388 wrote to memory of 2884	4388	56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe	y7815613.exe
PID 4388 wrote to memory of 2884	4388	56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe	y7815613.exe
PID 4388 wrote to memory of 2884	4388	56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe	y7815613.exe
PID 2884 wrote to memory of 1564	2884	y7815613.exe	y2813514.exe
PID 2884 wrote to memory of 1564	2884	y7815613.exe	y2813514.exe
PID 2884 wrote to memory of 1564	2884	y7815613.exe	y2813514.exe
PID 1564 wrote to memory of 4184	1564	y2813514.exe	y2004158.exe
PID 1564 wrote to memory of 4184	1564	y2813514.exe	y2004158.exe
PID 1564 wrote to memory of 4184	1564	y2813514.exe	y2004158.exe
PID 4184 wrote to memory of 3208	4184	y2004158.exe	j0025530.exe
PID 4184 wrote to memory of 3208	4184	y2004158.exe	j0025530.exe
PID 4184 wrote to memory of 3208	4184	y2004158.exe	j0025530.exe
PID 3208 wrote to memory of 4664	3208	j0025530.exe	AppLaunch.exe
PID 3208 wrote to memory of 4664	3208	j0025530.exe	AppLaunch.exe
PID 3208 wrote to memory of 4664	3208	j0025530.exe	AppLaunch.exe
PID 3208 wrote to memory of 4664	3208	j0025530.exe	AppLaunch.exe
PID 3208 wrote to memory of 4664	3208	j0025530.exe	AppLaunch.exe
PID 4184 wrote to memory of 4480	4184	y2004158.exe	k3358457.exe
PID 4184 wrote to memory of 4480	4184	y2004158.exe	k3358457.exe
PID 1564 wrote to memory of 3964	1564	y2813514.exe	l5323032.exe
PID 1564 wrote to memory of 3964	1564	y2813514.exe	l5323032.exe
PID 1564 wrote to memory of 3964	1564	y2813514.exe	l5323032.exe

C:\Users\Admin\AppData\Local\Temp\56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe
"C:\Users\Admin\AppData\Local\Temp\56d491a801475e9b14ae38bdc4fea972e551e05c53781d24dbecf416d9d2d3ad.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7815613.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7815613.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2813514.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2813514.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2004158.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2004158.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4184

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0025530.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0025530.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 596
6⤵
- Program crash
PID:4564

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k3358457.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k3358457.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe
4⤵
- Executes dropped EXE
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3208 -ip 3208
1⤵
PID:3512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7815613.exe
Filesize
538KB

MD5
2d09c7b7734bc16ebcec618edf2f32d6

SHA1
9f0a279602bbea20e4184e340ec4593e39b8a212

SHA256
f7f04dbd2129c9850e1dfd65bc3d675c83bf63d090ddccb4aeaba71169791776

SHA512
285cdf1f30c257b4a79f63c0a2017df95c5a0ae8655b328dada1fe055bb51a524090de7071c60d68b854f3955ca18ed12785cc2af3333210ee8574e11839c31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7815613.exe
Filesize
538KB

MD5
2d09c7b7734bc16ebcec618edf2f32d6

SHA1
9f0a279602bbea20e4184e340ec4593e39b8a212

SHA256
f7f04dbd2129c9850e1dfd65bc3d675c83bf63d090ddccb4aeaba71169791776

SHA512
285cdf1f30c257b4a79f63c0a2017df95c5a0ae8655b328dada1fe055bb51a524090de7071c60d68b854f3955ca18ed12785cc2af3333210ee8574e11839c31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2813514.exe
Filesize
366KB

MD5
e753987d70e0f527ce1b18c121503b28

SHA1
d6a51265111f6eee4df3ee6fb1fb5ba2b2e48459

SHA256
44627e92cfda4693affba1945844e179f9f8af5da191f86d569fd9b5def3bbe9

SHA512
99f3e3842e55d84dacd60d4c6b29a53aaed4db46e3179217bb9aa3981b37df33914cef990875d8b83ae545a7b415bac426b7f2a90f54b645a3a932fcc619f342

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2813514.exe
Filesize
366KB

MD5
e753987d70e0f527ce1b18c121503b28

SHA1
d6a51265111f6eee4df3ee6fb1fb5ba2b2e48459

SHA256
44627e92cfda4693affba1945844e179f9f8af5da191f86d569fd9b5def3bbe9

SHA512
99f3e3842e55d84dacd60d4c6b29a53aaed4db46e3179217bb9aa3981b37df33914cef990875d8b83ae545a7b415bac426b7f2a90f54b645a3a932fcc619f342

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe
Filesize
173KB

MD5
e2554c4f26deb19d9b24e8ea09066d29

SHA1
1d87b7ed04132f703273a1858ec696eeca93beef

SHA256
6fb7353cf69894a1723dde9c82cb9bd4465016b3b5eaf3c7e24d70e2f3bf8734

SHA512
8cc827c74493ceabe4b59132fc66efd81d6ecf84aac006029b3bc3992285a466895d6db81ae14baed47cbec9af3a5c88f93463df721e1f88a7275e47d2bc7f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5323032.exe
Filesize
173KB

MD5
e2554c4f26deb19d9b24e8ea09066d29

SHA1
1d87b7ed04132f703273a1858ec696eeca93beef

SHA256
6fb7353cf69894a1723dde9c82cb9bd4465016b3b5eaf3c7e24d70e2f3bf8734

SHA512
8cc827c74493ceabe4b59132fc66efd81d6ecf84aac006029b3bc3992285a466895d6db81ae14baed47cbec9af3a5c88f93463df721e1f88a7275e47d2bc7f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2004158.exe
Filesize
211KB

MD5
76b1aded92382601303cc6ae93e4b28a

SHA1
3861dedddb13dd480b8a0d5e49e1c7f58c843cd9

SHA256
32e03f27c748c981f0a63b6f6f42b44b6bfb4020a300816396afc6dac1481a50

SHA512
0e50d85c649880b0784a6e78ab35455d07f9be3d4f42ff442fdec50d8267aa19b053fad29b0d3a0ed1c57f7a782fe342bd994ec15ff0f000cb24eb8051efc22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2004158.exe
Filesize
211KB

MD5
76b1aded92382601303cc6ae93e4b28a

SHA1
3861dedddb13dd480b8a0d5e49e1c7f58c843cd9

SHA256
32e03f27c748c981f0a63b6f6f42b44b6bfb4020a300816396afc6dac1481a50

SHA512
0e50d85c649880b0784a6e78ab35455d07f9be3d4f42ff442fdec50d8267aa19b053fad29b0d3a0ed1c57f7a782fe342bd994ec15ff0f000cb24eb8051efc22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0025530.exe
Filesize
121KB

MD5
095fc9b9ed2d6b15cf63d9aa1b4856fd

SHA1
14642335f1c5dc8e169ab6b7b6c17f8c4b72bfab

SHA256
b9ab9e528d30bf5ac0026da0fdec7d7ab435710bb9efbf22df787b3e57c5506f

SHA512
b9a9988584232fbd6338d647c61abe7ad8b39377852f44232cdd515828155bdf822bbe36dbba91b73367c012c44afeb5424b9435e94556bc98b54edb4f0d7018

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0025530.exe
Filesize
121KB

MD5
095fc9b9ed2d6b15cf63d9aa1b4856fd

SHA1
14642335f1c5dc8e169ab6b7b6c17f8c4b72bfab

SHA256
b9ab9e528d30bf5ac0026da0fdec7d7ab435710bb9efbf22df787b3e57c5506f

SHA512
b9a9988584232fbd6338d647c61abe7ad8b39377852f44232cdd515828155bdf822bbe36dbba91b73367c012c44afeb5424b9435e94556bc98b54edb4f0d7018

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k3358457.exe
Filesize
13KB

MD5
74b4cd2879e230c46212c672b90c8dd7

SHA1
75b9a2a056e185f5279fa3a6687382a67b5e4e54

SHA256
cf58a20bed8654fc2c19bcf25f7d8d83571cd20265038e5152bde780ce137cba

SHA512
fb5a30964f477f07eda412c1fe7fba21856c4292ec13b8ce499faef8169471e4bebd8d8d1b0528ad6a17f7520efbf7630b5c73876eb4ac375801fe7a22d4c57f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k3358457.exe
Filesize
13KB

MD5
74b4cd2879e230c46212c672b90c8dd7

SHA1
75b9a2a056e185f5279fa3a6687382a67b5e4e54

SHA256
cf58a20bed8654fc2c19bcf25f7d8d83571cd20265038e5152bde780ce137cba

SHA512
fb5a30964f477f07eda412c1fe7fba21856c4292ec13b8ce499faef8169471e4bebd8d8d1b0528ad6a17f7520efbf7630b5c73876eb4ac375801fe7a22d4c57f

Download Submit
memory/3964-175-0x0000000000130000-0x0000000000160000-memory.dmp

Filesize
192KB

Download
memory/3964-176-0x000000000A620000-0x000000000AC38000-memory.dmp

Filesize
6.1MB

Download
memory/3964-177-0x000000000A110000-0x000000000A21A000-memory.dmp

Filesize
1.0MB

Download
memory/3964-178-0x000000000A000000-0x000000000A012000-memory.dmp

Filesize
72KB

Download
memory/3964-179-0x000000000A060000-0x000000000A09C000-memory.dmp

Filesize
240KB

Download
memory/3964-180-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3964-181-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/4480-169-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/4664-161-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download