redline | 904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe
Size

773KB
MD5

74875a30537f6a93e0f950308f0d7694
SHA1

dc71fc9ee08cefa28237fcb53fa4e4c788312055
SHA256

904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719
SHA512

cd48bbc9cf3ca1aa02ffc92ded99ef5d606745b18fbcefb87b12d822af64a096802bf9987de37dacc399904cbead29f1ef3a6634adbd7ed69a893d4ada05162d
SSDEEP

24576:2yE6S+nbQnGwyr3XdHaAKT5sJ/elJ1PVe2:FE+bKGwyRGkKJh

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

83.97.73.129:19068

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exea9927374.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9927374.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9927374.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a9927374.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9927374.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9927374.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9927374.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

v1188357.exev2860241.exev9199905.exea9927374.exeb5643169.exec7635963.exe

pid process

224 v1188357.exe
4704 v2860241.exe
4008 v9199905.exe
4300 a9927374.exe
4348 b5643169.exe
2808 c7635963.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

a9927374.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a9927374.exe

pid	process
224	v1188357.exe
4704	v2860241.exe
4008	v9199905.exe
4300	a9927374.exe
4348	b5643169.exe
2808	c7635963.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9927374.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v9199905.exe904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exev1188357.exev2860241.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9199905.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v1188357.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1188357.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v2860241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2860241.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9199905.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5643169.exe

description pid process target process

PID 4348 set thread context of 3248 4348 b5643169.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1348 4348 WerFault.exe b5643169.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a9927374.exeAppLaunch.exe

pid process

4300 a9927374.exe
4300 a9927374.exe
3248 AppLaunch.exe
3248 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a9927374.exeAppLaunch.exe

description pid process

Token: SeDebugPrivilege 4300 a9927374.exe
Token: SeDebugPrivilege 3248 AppLaunch.exe

description	pid	process	target process
PID 4348 set thread context of 3248	4348	b5643169.exe	AppLaunch.exe

pid	pid_target	process	target process
1348	4348	WerFault.exe	b5643169.exe

pid	process
4300	a9927374.exe
4300	a9927374.exe
3248	AppLaunch.exe
3248	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4300	a9927374.exe
Token: SeDebugPrivilege	3248	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exev1188357.exev2860241.exev9199905.exeb5643169.exe

description	pid	process	target process
PID 4932 wrote to memory of 224	4932	904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe	v1188357.exe
PID 4932 wrote to memory of 224	4932	904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe	v1188357.exe
PID 4932 wrote to memory of 224	4932	904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe	v1188357.exe
PID 224 wrote to memory of 4704	224	v1188357.exe	v2860241.exe
PID 224 wrote to memory of 4704	224	v1188357.exe	v2860241.exe
PID 224 wrote to memory of 4704	224	v1188357.exe	v2860241.exe
PID 4704 wrote to memory of 4008	4704	v2860241.exe	v9199905.exe
PID 4704 wrote to memory of 4008	4704	v2860241.exe	v9199905.exe
PID 4704 wrote to memory of 4008	4704	v2860241.exe	v9199905.exe
PID 4008 wrote to memory of 4300	4008	v9199905.exe	a9927374.exe
PID 4008 wrote to memory of 4300	4008	v9199905.exe	a9927374.exe
PID 4008 wrote to memory of 4348	4008	v9199905.exe	b5643169.exe
PID 4008 wrote to memory of 4348	4008	v9199905.exe	b5643169.exe
PID 4008 wrote to memory of 4348	4008	v9199905.exe	b5643169.exe
PID 4348 wrote to memory of 3248	4348	b5643169.exe	AppLaunch.exe
PID 4348 wrote to memory of 3248	4348	b5643169.exe	AppLaunch.exe
PID 4348 wrote to memory of 3248	4348	b5643169.exe	AppLaunch.exe
PID 4348 wrote to memory of 3248	4348	b5643169.exe	AppLaunch.exe
PID 4348 wrote to memory of 3248	4348	b5643169.exe	AppLaunch.exe
PID 4704 wrote to memory of 2808	4704	v2860241.exe	c7635963.exe
PID 4704 wrote to memory of 2808	4704	v2860241.exe	c7635963.exe
PID 4704 wrote to memory of 2808	4704	v2860241.exe	c7635963.exe

C:\Users\Admin\AppData\Local\Temp\904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe
"C:\Users\Admin\AppData\Local\Temp\904a5595da5fe765cfa2fafc92cbdee3459c5ed938501287242619569f3d8719.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1188357.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1188357.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2860241.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2860241.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9199905.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9199905.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4008

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9927374.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9927374.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5643169.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5643169.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 152
6⤵
- Program crash
PID:1348

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7635963.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7635963.exe
4⤵
- Executes dropped EXE
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4348 -ip 4348
1⤵
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1188357.exe
Filesize
549KB

MD5
fbe732d93f0f5656593e303a388d5a55

SHA1
c0a60a094db300e574181b7ba64e3a15be7d1456

SHA256
a72da29eb7ac2ea79b621c5815d815f9c0bbf18d4ed114bb869e87ca8f1a829e

SHA512
755e75b9ca926bbba11ed3e005f8d6e9b14736d0b3cc44505c9d9ed775ad22736b9fca4229e99dfa90c30ed629857e7a4b3df8e38407f9afc49fa7c48f06159c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1188357.exe
Filesize
549KB

MD5
fbe732d93f0f5656593e303a388d5a55

SHA1
c0a60a094db300e574181b7ba64e3a15be7d1456

SHA256
a72da29eb7ac2ea79b621c5815d815f9c0bbf18d4ed114bb869e87ca8f1a829e

SHA512
755e75b9ca926bbba11ed3e005f8d6e9b14736d0b3cc44505c9d9ed775ad22736b9fca4229e99dfa90c30ed629857e7a4b3df8e38407f9afc49fa7c48f06159c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2860241.exe
Filesize
376KB

MD5
a0cdf9ad9926ff7ea4f772f104e8f21d

SHA1
2fe514ead438b5ed45dd9960836d9a2daa4ef08e

SHA256
4d73f7819a0856d3671a9e178b6c97612986cb2d3c05b99482c8a6350b294f0c

SHA512
df3712edc6e09b8f4f6be37e5eba2f5c9614aadd7560b5cfb42ae998246ecc6ff3bb9ff4e7d5b12b2afb8d9579073a4939c497a319726450daba9f2da569fa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2860241.exe
Filesize
376KB

MD5
a0cdf9ad9926ff7ea4f772f104e8f21d

SHA1
2fe514ead438b5ed45dd9960836d9a2daa4ef08e

SHA256
4d73f7819a0856d3671a9e178b6c97612986cb2d3c05b99482c8a6350b294f0c

SHA512
df3712edc6e09b8f4f6be37e5eba2f5c9614aadd7560b5cfb42ae998246ecc6ff3bb9ff4e7d5b12b2afb8d9579073a4939c497a319726450daba9f2da569fa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7635963.exe
Filesize
172KB

MD5
d932ce6cfd20b8d948b377bf8b2f0b70

SHA1
95a2bb037cfb63f45c84bdca5dd517a54023a21c

SHA256
7e81a222f64680d20c4577735bc51f086e3d6fa602f6eb04957810ae5b34e268

SHA512
d2dc630a8169c7e0536c45a302298cb161289fcd2290af68f090938412dd14f4e93f1e215e8caa3c184f2e9e922b55d639d04f884d9771bdbbc9d19ace72f882

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7635963.exe
Filesize
172KB

MD5
d932ce6cfd20b8d948b377bf8b2f0b70

SHA1
95a2bb037cfb63f45c84bdca5dd517a54023a21c

SHA256
7e81a222f64680d20c4577735bc51f086e3d6fa602f6eb04957810ae5b34e268

SHA512
d2dc630a8169c7e0536c45a302298cb161289fcd2290af68f090938412dd14f4e93f1e215e8caa3c184f2e9e922b55d639d04f884d9771bdbbc9d19ace72f882

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9199905.exe
Filesize
221KB

MD5
ab2ed13169b510bd0b739cceaab6da08

SHA1
bbe59162618e39b2e8b79414e07c408d6f20e6b7

SHA256
c46cf05975535c93cf5dbc9e8fb7d65cab27e3c622bae962570e3f087975ea12

SHA512
76271bd5b38105d584cf8b2d42e52ccac6540584cfa296bc2898a243d5febd92675c50ce4695345676bf02f9bc430e1ea98b362516b90a3383c642ab66f893fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9199905.exe
Filesize
221KB

MD5
ab2ed13169b510bd0b739cceaab6da08

SHA1
bbe59162618e39b2e8b79414e07c408d6f20e6b7

SHA256
c46cf05975535c93cf5dbc9e8fb7d65cab27e3c622bae962570e3f087975ea12

SHA512
76271bd5b38105d584cf8b2d42e52ccac6540584cfa296bc2898a243d5febd92675c50ce4695345676bf02f9bc430e1ea98b362516b90a3383c642ab66f893fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9927374.exe
Filesize
14KB

MD5
57ac6fec4f2ea8f48781b8546180c0c4

SHA1
4865feaa5eac7b178a74b6870c66cf13092971e9

SHA256
9d2365dfa2fff7e5f559cd3f91be02f4692d8a8083716a0bd0dcc9318717ef37

SHA512
579cfd3dc0ee237e18c8e178b1af91df2fff5cbe41234ed96166e6d056d06c193b898c3a8a624a9fa3b81df6142033f1d8dbe9235f61fe467c6ad8f386e60dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9927374.exe
Filesize
14KB

MD5
57ac6fec4f2ea8f48781b8546180c0c4

SHA1
4865feaa5eac7b178a74b6870c66cf13092971e9

SHA256
9d2365dfa2fff7e5f559cd3f91be02f4692d8a8083716a0bd0dcc9318717ef37

SHA512
579cfd3dc0ee237e18c8e178b1af91df2fff5cbe41234ed96166e6d056d06c193b898c3a8a624a9fa3b81df6142033f1d8dbe9235f61fe467c6ad8f386e60dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5643169.exe
Filesize
148KB

MD5
fcf23dc3c5fd2fe1d608dfd1c26c8265

SHA1
d9d5ca89597415be80d8ebef9172a2dfd205ca13

SHA256
251d9b8b461f8dbfc2fbdf30b7bcb55d74f3887b28746842558a7b041b3b91f7

SHA512
d557300d32cbe85e54ea82cdeb84047722414aa2caf6ab53ca400c240d22463b9b0613fa98df1b9e961860ae68e12b936f991188dcd4c0cfc00d7e7a0f52b457

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5643169.exe
Filesize
148KB

MD5
fcf23dc3c5fd2fe1d608dfd1c26c8265

SHA1
d9d5ca89597415be80d8ebef9172a2dfd205ca13

SHA256
251d9b8b461f8dbfc2fbdf30b7bcb55d74f3887b28746842558a7b041b3b91f7

SHA512
d557300d32cbe85e54ea82cdeb84047722414aa2caf6ab53ca400c240d22463b9b0613fa98df1b9e961860ae68e12b936f991188dcd4c0cfc00d7e7a0f52b457

Download Submit
memory/2808-174-0x0000000000420000-0x0000000000450000-memory.dmp

Filesize
192KB

Download
memory/2808-175-0x000000000A860000-0x000000000AE78000-memory.dmp

Filesize
6.1MB

Download
memory/2808-176-0x000000000A3A0000-0x000000000A4AA000-memory.dmp

Filesize
1.0MB

Download
memory/2808-177-0x000000000A2E0000-0x000000000A2F2000-memory.dmp

Filesize
72KB

Download
memory/2808-178-0x000000000A340000-0x000000000A37C000-memory.dmp

Filesize
240KB

Download
memory/2808-179-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/2808-181-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/3248-166-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/4300-161-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download