redline | d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe
Size

773KB
MD5

bdcc36ea3621040799270f47d16edf83
SHA1

e2ba36a884c3490688928a0e156ba7a21f07e780
SHA256

d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e
SHA512

17a8a94f259d66999cd68c023af0a63219a1fffe0e1abc0d78c0d810fcd99778a43a214d5ce1d45fc2eb4cae6cd460b725dcc84f3d9487372871775928951d64
SSDEEP

24576:RyIr4aRcI8iYlwngnKkB+j5+peiCafMlg:ES4st8hWM+j0peiCafMl

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a3091715.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3091715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3091715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3091715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3091715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3091715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3091715.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v9744708.exev0829283.exev3937264.exea3091715.exeb4654070.exec2690761.exe

pid process

2220 v9744708.exe
1860 v0829283.exe
3268 v3937264.exe
1524 a3091715.exe
320 b4654070.exe
2148 c2690761.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a3091715.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a3091715.exe

pid	process
2220	v9744708.exe
1860	v0829283.exe
3268	v3937264.exe
1524	a3091715.exe
320	b4654070.exe
2148	c2690761.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3091715.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v9744708.exev0829283.exev3937264.exed5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9744708.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v0829283.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0829283.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3937264.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3937264.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9744708.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4654070.exe

description pid process target process

PID 320 set thread context of 4352 320 b4654070.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3840 320 WerFault.exe b4654070.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a3091715.exeAppLaunch.exe

pid process

1524 a3091715.exe
1524 a3091715.exe
4352 AppLaunch.exe
4352 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3091715.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 1524 a3091715.exe
Token: SeDebugPrivilege 4352 AppLaunch.exe

description	pid	process	target process
PID 320 set thread context of 4352	320	b4654070.exe	AppLaunch.exe

pid	pid_target	process	target process
3840	320	WerFault.exe	b4654070.exe

pid	process
1524	a3091715.exe
1524	a3091715.exe
4352	AppLaunch.exe
4352	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1524	a3091715.exe
Token: SeDebugPrivilege	4352	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exev9744708.exev0829283.exev3937264.exeb4654070.exe

description	pid	process	target process
PID 2076 wrote to memory of 2220	2076	d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe	v9744708.exe
PID 2076 wrote to memory of 2220	2076	d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe	v9744708.exe
PID 2076 wrote to memory of 2220	2076	d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe	v9744708.exe
PID 2220 wrote to memory of 1860	2220	v9744708.exe	v0829283.exe
PID 2220 wrote to memory of 1860	2220	v9744708.exe	v0829283.exe
PID 2220 wrote to memory of 1860	2220	v9744708.exe	v0829283.exe
PID 1860 wrote to memory of 3268	1860	v0829283.exe	v3937264.exe
PID 1860 wrote to memory of 3268	1860	v0829283.exe	v3937264.exe
PID 1860 wrote to memory of 3268	1860	v0829283.exe	v3937264.exe
PID 3268 wrote to memory of 1524	3268	v3937264.exe	a3091715.exe
PID 3268 wrote to memory of 1524	3268	v3937264.exe	a3091715.exe
PID 3268 wrote to memory of 320	3268	v3937264.exe	b4654070.exe
PID 3268 wrote to memory of 320	3268	v3937264.exe	b4654070.exe
PID 3268 wrote to memory of 320	3268	v3937264.exe	b4654070.exe
PID 320 wrote to memory of 4352	320	b4654070.exe	AppLaunch.exe
PID 320 wrote to memory of 4352	320	b4654070.exe	AppLaunch.exe
PID 320 wrote to memory of 4352	320	b4654070.exe	AppLaunch.exe
PID 320 wrote to memory of 4352	320	b4654070.exe	AppLaunch.exe
PID 320 wrote to memory of 4352	320	b4654070.exe	AppLaunch.exe
PID 1860 wrote to memory of 2148	1860	v0829283.exe	c2690761.exe
PID 1860 wrote to memory of 2148	1860	v0829283.exe	c2690761.exe
PID 1860 wrote to memory of 2148	1860	v0829283.exe	c2690761.exe

C:\Users\Admin\AppData\Local\Temp\d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe
"C:\Users\Admin\AppData\Local\Temp\d5547b2813bccd816bc0ccb00564737a46407e34912105b2703e19390768887e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744708.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744708.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0829283.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0829283.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3937264.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3937264.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3091715.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3091715.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4654070.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4654070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:320
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 608
        6⤵
        Program crash
        
        PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2690761.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2690761.exe
      4⤵
      Executes dropped EXE
      PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 320 -ip 320
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744708.exe

Filesize
549KB

MD5
7199200eddca7756d9e9d3c68e404c9e

SHA1
f5a9cf855f508c961bd332dab960ce0b93a08ab9

SHA256
1811acd9a41a9afb1fee1de371aac83438e15fb9e23b0287ea5ff65f93022765

SHA512
2b113392ae3a5ffe0ceb7b13c0ea2d7499dac43cbdc6cfe078dc827c417b373b6b0ca0a2246e51f4d43d62fac0e88157695573176a5fd9033876ef69ca201096

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744708.exe

Filesize
549KB

MD5
7199200eddca7756d9e9d3c68e404c9e

SHA1
f5a9cf855f508c961bd332dab960ce0b93a08ab9

SHA256
1811acd9a41a9afb1fee1de371aac83438e15fb9e23b0287ea5ff65f93022765

SHA512
2b113392ae3a5ffe0ceb7b13c0ea2d7499dac43cbdc6cfe078dc827c417b373b6b0ca0a2246e51f4d43d62fac0e88157695573176a5fd9033876ef69ca201096

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0829283.exe

Filesize
377KB

MD5
38a74de6c95d4bae3aeb0347c9d7527d

SHA1
b8e7d72d48f636c3e3c48140e3c65a8155acbc21

SHA256
cf05ba33716fe292a2240aaed3256063a02dc8217ce5d3c85bda3de40e03c325

SHA512
5844f689470a611562fe3f063471c93a15ee36139726e863fb6c82ffe4acdad6613919b93511efefd7bd28ec7a5a1a599a15fafa82755866f427af9226d88ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0829283.exe

Filesize
377KB

MD5
38a74de6c95d4bae3aeb0347c9d7527d

SHA1
b8e7d72d48f636c3e3c48140e3c65a8155acbc21

SHA256
cf05ba33716fe292a2240aaed3256063a02dc8217ce5d3c85bda3de40e03c325

SHA512
5844f689470a611562fe3f063471c93a15ee36139726e863fb6c82ffe4acdad6613919b93511efefd7bd28ec7a5a1a599a15fafa82755866f427af9226d88ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2690761.exe

Filesize
172KB

MD5
053cd923314974e622090d2682eb3f23

SHA1
b41700a3aba2c40e8364d263588aa9641633c516

SHA256
4bfabe50e542c97c3984e9eb29bf31fe3cc96748c9689dffe491c30d8f561082

SHA512
24521312446f053587af7ea412115724a2eb89879229337f87ebeec1d085477f674855b5f17636f84fa79707fef3e115ddddcc54856facb056120a3ab84c3e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2690761.exe

Filesize
172KB

MD5
053cd923314974e622090d2682eb3f23

SHA1
b41700a3aba2c40e8364d263588aa9641633c516

SHA256
4bfabe50e542c97c3984e9eb29bf31fe3cc96748c9689dffe491c30d8f561082

SHA512
24521312446f053587af7ea412115724a2eb89879229337f87ebeec1d085477f674855b5f17636f84fa79707fef3e115ddddcc54856facb056120a3ab84c3e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3937264.exe

Filesize
221KB

MD5
114af38bb423bf285ffeb58a96b8a535

SHA1
758a6d5d87ff4ba24914924f766784de1214af93

SHA256
09e8e6f1d0808441f3e1eaa736912f0ab5082e38c95f4b41bd118bff2033ce4b

SHA512
cd83234a3f6c004672c55160849945d342c431bc061639aba88f52917187df7cbefd64a206bcf710a9409ed0c5c13282ab0e52314653385c96fd68ac62fa46e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3937264.exe

Filesize
221KB

MD5
114af38bb423bf285ffeb58a96b8a535

SHA1
758a6d5d87ff4ba24914924f766784de1214af93

SHA256
09e8e6f1d0808441f3e1eaa736912f0ab5082e38c95f4b41bd118bff2033ce4b

SHA512
cd83234a3f6c004672c55160849945d342c431bc061639aba88f52917187df7cbefd64a206bcf710a9409ed0c5c13282ab0e52314653385c96fd68ac62fa46e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3091715.exe

Filesize
14KB

MD5
dc0313cc091a18851a022bbc763161ee

SHA1
f66e480ea2c4c30a1dfa418953970556bd38e4d3

SHA256
a5bcee88c8026bce624ec55c78e546af7d45061d67cc81da83940ae6c90e0ef9

SHA512
a5f8a199b7e501890933b2bf21cbdd93f55093ab3220aa5a733d711714098087ff30d5a7b92bf8df7700e0855afc6a2d257de852ceb7ddedbf1efa113d65df17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3091715.exe

Filesize
14KB

MD5
dc0313cc091a18851a022bbc763161ee

SHA1
f66e480ea2c4c30a1dfa418953970556bd38e4d3

SHA256
a5bcee88c8026bce624ec55c78e546af7d45061d67cc81da83940ae6c90e0ef9

SHA512
a5f8a199b7e501890933b2bf21cbdd93f55093ab3220aa5a733d711714098087ff30d5a7b92bf8df7700e0855afc6a2d257de852ceb7ddedbf1efa113d65df17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4654070.exe

Filesize
148KB

MD5
fe3f96779c1a9ba13afe600ec2618329

SHA1
13097efd6a3d5cda04baa4a760435fe9d69ff3a8

SHA256
d36941fc9ab69427f9aa7e41b76395cff06f3f3ae7d1b6f977d37839c1aad834

SHA512
f8df119dce8f0d991a0d8f9815c5803af93bd34a0d484ae2d8103cf0fbb69c62ad1bac04d061400a5ddff8f3c4f7245afd2f7c546642da4aa165cc22c4e8cf1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4654070.exe

Filesize
148KB

MD5
fe3f96779c1a9ba13afe600ec2618329

SHA1
13097efd6a3d5cda04baa4a760435fe9d69ff3a8

SHA256
d36941fc9ab69427f9aa7e41b76395cff06f3f3ae7d1b6f977d37839c1aad834

SHA512
f8df119dce8f0d991a0d8f9815c5803af93bd34a0d484ae2d8103cf0fbb69c62ad1bac04d061400a5ddff8f3c4f7245afd2f7c546642da4aa165cc22c4e8cf1b

Download Submit
memory/1524-161-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Filesize
40KB

Download
memory/2148-174-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

Filesize
192KB

Download
memory/2148-175-0x000000000B3C0000-0x000000000B9D8000-memory.dmp

Filesize
6.1MB

Download
memory/2148-176-0x000000000AF40000-0x000000000B04A000-memory.dmp

Filesize
1.0MB

Download
memory/2148-177-0x000000000AE80000-0x000000000AE92000-memory.dmp

Filesize
72KB

Download
memory/2148-178-0x000000000AEE0000-0x000000000AF1C000-memory.dmp

Filesize
240KB

Download
memory/2148-179-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2148-181-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/4352-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download