redline | 51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2023 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f47bd808f90fbe4e53eaed4a71793239.exe
Size

726KB
MD5

f47bd808f90fbe4e53eaed4a71793239
SHA1

e86d65125e39115835b9a615a30cf820dd3d1914
SHA256

51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1
SHA512

0cc8ee9ed4b9712738e391928ff4f427adcf61d4c6ba4010e637f3b175101d25d64b054f756a2207c09fb9d8050ba0712360e99cea730873c3b5c3b44feb6248
SSDEEP

12288:KMrvy90NaHstfEo9L5Ksebs6pLFfbIBX2hVYdWDfULXSr8AXD+QR:1y0L5ubbhsBX2h5DfW3W

Score

10^/10

redline dast evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dast

83.97.73.129:19068

Attributes

auth_value
17d71bf1a3f93284f5848e00b0dd8222

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

j3723913.exek9332225.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	j3723913.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k9332225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9332225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9332225.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9332225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9332225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9332225.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 6 IoCs

Processes:

y8998677.exey0574687.exey3746853.exej3723913.exek9332225.exel9927926.exe

pid process

1220 y8998677.exe
4156 y0574687.exe
788 y3746853.exe
2464 j3723913.exe
520 k9332225.exe
4560 l9927926.exe

pid	process
1220	y8998677.exe
4156	y0574687.exe
788	y3746853.exe
2464	j3723913.exe
520	k9332225.exe
4560	l9927926.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

j3723913.exek9332225.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	j3723913.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9332225.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f47bd808f90fbe4e53eaed4a71793239.exey8998677.exey0574687.exey3746853.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f47bd808f90fbe4e53eaed4a71793239.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y8998677.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8998677.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0574687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0574687.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y3746853.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y3746853.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f47bd808f90fbe4e53eaed4a71793239.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

j3723913.exek9332225.exe

pid process

2464 j3723913.exe
2464 j3723913.exe
520 k9332225.exe
520 k9332225.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

j3723913.exek9332225.exe

description pid process

Token: SeDebugPrivilege 2464 j3723913.exe
Token: SeDebugPrivilege 520 k9332225.exe

pid	process
2464	j3723913.exe
2464	j3723913.exe
520	k9332225.exe
520	k9332225.exe

description	pid	process
Token: SeDebugPrivilege	2464	j3723913.exe
Token: SeDebugPrivilege	520	k9332225.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f47bd808f90fbe4e53eaed4a71793239.exey8998677.exey0574687.exey3746853.exe

description	pid	process	target process
PID 1728 wrote to memory of 1220	1728	f47bd808f90fbe4e53eaed4a71793239.exe	y8998677.exe
PID 1728 wrote to memory of 1220	1728	f47bd808f90fbe4e53eaed4a71793239.exe	y8998677.exe
PID 1728 wrote to memory of 1220	1728	f47bd808f90fbe4e53eaed4a71793239.exe	y8998677.exe
PID 1220 wrote to memory of 4156	1220	y8998677.exe	y0574687.exe
PID 1220 wrote to memory of 4156	1220	y8998677.exe	y0574687.exe
PID 1220 wrote to memory of 4156	1220	y8998677.exe	y0574687.exe
PID 4156 wrote to memory of 788	4156	y0574687.exe	y3746853.exe
PID 4156 wrote to memory of 788	4156	y0574687.exe	y3746853.exe
PID 4156 wrote to memory of 788	4156	y0574687.exe	y3746853.exe
PID 788 wrote to memory of 2464	788	y3746853.exe	j3723913.exe
PID 788 wrote to memory of 2464	788	y3746853.exe	j3723913.exe
PID 788 wrote to memory of 2464	788	y3746853.exe	j3723913.exe
PID 788 wrote to memory of 520	788	y3746853.exe	k9332225.exe
PID 788 wrote to memory of 520	788	y3746853.exe	k9332225.exe
PID 4156 wrote to memory of 4560	4156	y0574687.exe	l9927926.exe
PID 4156 wrote to memory of 4560	4156	y0574687.exe	l9927926.exe
PID 4156 wrote to memory of 4560	4156	y0574687.exe	l9927926.exe

C:\Users\Admin\AppData\Local\Temp\f47bd808f90fbe4e53eaed4a71793239.exe
"C:\Users\Admin\AppData\Local\Temp\f47bd808f90fbe4e53eaed4a71793239.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8998677.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8998677.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0574687.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0574687.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4156

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3746853.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3746853.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j3723913.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j3723913.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9332225.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9332225.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9927926.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9927926.exe
4⤵
- Executes dropped EXE
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8998677.exe
Filesize
525KB

MD5
46c8aad72a46f46ce1671876cf1842af

SHA1
7f3da9c421d1161fdc445d5030acf477b895593a

SHA256
86e755a214a1b32db740e06aa1705a82929d74fd5cd177d1511946785be5c195

SHA512
ba57f00015306185ad16fcabb064a341d6e5b8f35f29bcbde3a76db3529c8a2099cc930736d7ffed1cbec29003b8e47cddb586b88b8013b63c684ebba44e65ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8998677.exe
Filesize
525KB

MD5
46c8aad72a46f46ce1671876cf1842af

SHA1
7f3da9c421d1161fdc445d5030acf477b895593a

SHA256
86e755a214a1b32db740e06aa1705a82929d74fd5cd177d1511946785be5c195

SHA512
ba57f00015306185ad16fcabb064a341d6e5b8f35f29bcbde3a76db3529c8a2099cc930736d7ffed1cbec29003b8e47cddb586b88b8013b63c684ebba44e65ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0574687.exe
Filesize
353KB

MD5
d96b94ae32685480d9cb283557f610e2

SHA1
deb3fdd7e6e33969c4c59c409e3efdeb75cb81fc

SHA256
e6459d7e4fcdd926f081c200ed9306c0bf40ed78a3b64800ec82c802f6062db7

SHA512
a041d0528e6c9cd70cb1526dcabc2e1a06616d14b2876e6ab2c61f9cfad60df90480260af9c93c2e97bd956975a4d4a60ca9efc288b2042b3cff86db6cb8c2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0574687.exe
Filesize
353KB

MD5
d96b94ae32685480d9cb283557f610e2

SHA1
deb3fdd7e6e33969c4c59c409e3efdeb75cb81fc

SHA256
e6459d7e4fcdd926f081c200ed9306c0bf40ed78a3b64800ec82c802f6062db7

SHA512
a041d0528e6c9cd70cb1526dcabc2e1a06616d14b2876e6ab2c61f9cfad60df90480260af9c93c2e97bd956975a4d4a60ca9efc288b2042b3cff86db6cb8c2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9927926.exe
Filesize
173KB

MD5
58f9100abe8c3b3f080c2f5f8f592915

SHA1
7f901f5f1554e7d7d3b25fdf578795f60c701351

SHA256
1bf98ccaa5ed4154863554d024a580d797eeca6d11d9d461a5df2a8989c52dca

SHA512
d1c7d1201b2140382b7c5e22e49b0d06582c203f274a7a86dbe696fc4e85d923b9c29dd30a014c2f60b33adec7bf69808241119c4f41cd7dc7748923035a1d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9927926.exe
Filesize
173KB

MD5
58f9100abe8c3b3f080c2f5f8f592915

SHA1
7f901f5f1554e7d7d3b25fdf578795f60c701351

SHA256
1bf98ccaa5ed4154863554d024a580d797eeca6d11d9d461a5df2a8989c52dca

SHA512
d1c7d1201b2140382b7c5e22e49b0d06582c203f274a7a86dbe696fc4e85d923b9c29dd30a014c2f60b33adec7bf69808241119c4f41cd7dc7748923035a1d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3746853.exe
Filesize
198KB

MD5
7e4a23801c3577e5f0c127e4049758a5

SHA1
e01d897ddbbf3a77590cdb6ba073b4df7e6d9f91

SHA256
ce0cf272a8666d7ab020775e9f0297d06c01a4a8dc09871e61d8385e065c2f09

SHA512
ad159185d4ffda02284a7b454fc71d47ecf3852cbf8b54ed347f22b88ca6d5a7ea57a136338af482f92d4c66b98ba1f79ad38da9f74dc7a96e1a08576a80a865

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3746853.exe
Filesize
198KB

MD5
7e4a23801c3577e5f0c127e4049758a5

SHA1
e01d897ddbbf3a77590cdb6ba073b4df7e6d9f91

SHA256
ce0cf272a8666d7ab020775e9f0297d06c01a4a8dc09871e61d8385e065c2f09

SHA512
ad159185d4ffda02284a7b454fc71d47ecf3852cbf8b54ed347f22b88ca6d5a7ea57a136338af482f92d4c66b98ba1f79ad38da9f74dc7a96e1a08576a80a865

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j3723913.exe
Filesize
97KB

MD5
17b47d8ee14a13d5ead0f1064c795e96

SHA1
284240ce15d09c3104370035c96ae3c888e90dae

SHA256
9f812931cedebdf6f2903e2c44866f47809bfe56da6388762ff8860c737bf287

SHA512
b7a9ab0324c2324fddd6a8354871ff8840f6a393f9bbea0b52dcb43d8a120fab226205f642e22da12845e806d7c20f940985cf2395d1fe50754ed86d498e6fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j3723913.exe
Filesize
97KB

MD5
17b47d8ee14a13d5ead0f1064c795e96

SHA1
284240ce15d09c3104370035c96ae3c888e90dae

SHA256
9f812931cedebdf6f2903e2c44866f47809bfe56da6388762ff8860c737bf287

SHA512
b7a9ab0324c2324fddd6a8354871ff8840f6a393f9bbea0b52dcb43d8a120fab226205f642e22da12845e806d7c20f940985cf2395d1fe50754ed86d498e6fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9332225.exe
Filesize
11KB

MD5
5c1baa83c62c23a4a02b0b8894a71cc7

SHA1
3e4bc940e78696d45c3b38f277bafeb4cc4d134d

SHA256
4e60fe33c02afbb69575475caeabd6f40d56da6c587a93337a06449c7725e934

SHA512
5ffc894412c13212504c41ef14bd939ca11bc227b2f70756de2f7249faa3655191480f39f7d7f40dd61fd95325ec268b7d28926a200875e9318fb537c5b7183e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9332225.exe
Filesize
11KB

MD5
5c1baa83c62c23a4a02b0b8894a71cc7

SHA1
3e4bc940e78696d45c3b38f277bafeb4cc4d134d

SHA256
4e60fe33c02afbb69575475caeabd6f40d56da6c587a93337a06449c7725e934

SHA512
5ffc894412c13212504c41ef14bd939ca11bc227b2f70756de2f7249faa3655191480f39f7d7f40dd61fd95325ec268b7d28926a200875e9318fb537c5b7183e

Download Submit
memory/520-170-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Filesize
40KB

Download
memory/2464-161-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/4560-175-0x00000000007F0000-0x0000000000820000-memory.dmp

Filesize
192KB

Download
memory/4560-176-0x000000000AC10000-0x000000000B228000-memory.dmp

Filesize
6.1MB

Download
memory/4560-177-0x000000000A770000-0x000000000A87A000-memory.dmp

Filesize
1.0MB

Download
memory/4560-178-0x000000000A6B0000-0x000000000A6C2000-memory.dmp

Filesize
72KB

Download
memory/4560-179-0x000000000A710000-0x000000000A74C000-memory.dmp

Filesize
240KB

Download
memory/4560-180-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4560-181-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download