redline | 3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347

General

Target

3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe
Size

1.0MB
MD5

66522b2ee5c54d2e3b503e8036ac90f1
SHA1

48786a4b83eda38b9b58c4c6d8c83ad24daf9e6c
SHA256

3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347
SHA512

5e613cb8f5ed937db9daa8efd80d901d6e8ebc83c036190994dd34dfca6944fa0c98fb7033fb64dd707e083f16398dc4104e4ff188c5f53e3a607ce00a3582f2
SSDEEP

24576:BypHJipy0vBcyvakncO6Oo3g+BrMgjlhg:0pJY3ok96Oo3gEl

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19062

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a3426371.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3426371.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3426371.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 4 IoCs

Processes:

v5084366.exev3439787.exea3426371.exeb7297900.exe

pid process

4608 v5084366.exe
4908 v3439787.exe
4840 a3426371.exe
4460 b7297900.exe

pid	process
4608	v5084366.exe
4908	v3439787.exe
4840	a3426371.exe
4460	b7297900.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

a3426371.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3426371.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v5084366.exev3439787.exe3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5084366.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3439787.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3439787.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5084366.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3426371.exe

pid process

4840 a3426371.exe
4840 a3426371.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3426371.exe

description pid process

Token: SeDebugPrivilege 4840 a3426371.exe

pid	process
4840	a3426371.exe
4840	a3426371.exe

description	pid	process
Token: SeDebugPrivilege	4840	a3426371.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exev5084366.exev3439787.exe

description	pid	process	target process
PID 4120 wrote to memory of 4608	4120	3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe	v5084366.exe
PID 4120 wrote to memory of 4608	4120	3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe	v5084366.exe
PID 4120 wrote to memory of 4608	4120	3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe	v5084366.exe
PID 4608 wrote to memory of 4908	4608	v5084366.exe	v3439787.exe
PID 4608 wrote to memory of 4908	4608	v5084366.exe	v3439787.exe
PID 4608 wrote to memory of 4908	4608	v5084366.exe	v3439787.exe
PID 4908 wrote to memory of 4840	4908	v3439787.exe	a3426371.exe
PID 4908 wrote to memory of 4840	4908	v3439787.exe	a3426371.exe
PID 4908 wrote to memory of 4840	4908	v3439787.exe	a3426371.exe
PID 4908 wrote to memory of 4460	4908	v3439787.exe	b7297900.exe
PID 4908 wrote to memory of 4460	4908	v3439787.exe	b7297900.exe
PID 4908 wrote to memory of 4460	4908	v3439787.exe	b7297900.exe

C:\Users\Admin\AppData\Local\Temp\3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe
"C:\Users\Admin\AppData\Local\Temp\3b95bf80d167c23f7744d306d0a200231c8bde551941b63f73d94a6b72174347.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4120

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5084366.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5084366.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4608

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3439787.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3439787.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3426371.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3426371.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7297900.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7297900.exe
4⤵
- Executes dropped EXE
PID:4460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5084366.exe
Filesize
749KB

MD5
d13cdcc7a3e4b53c6353806332e2a38c

SHA1
3c077fca0e2c0164d0b3e64bf736ff657617eb64

SHA256
4d84a8443fa38a0e67764103a311bf6a6a69683b9686cc4d861a88566d4c4f71

SHA512
5a58fe0028a274999ed288adc9be7a584c1c76c2ef4dc3df6f44e67b9aeb475499135449c1ec9adf4ec2413dc4e6ec6d87ae2134311ccafd0ad75c0c44e8af70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5084366.exe
Filesize
749KB

MD5
d13cdcc7a3e4b53c6353806332e2a38c

SHA1
3c077fca0e2c0164d0b3e64bf736ff657617eb64

SHA256
4d84a8443fa38a0e67764103a311bf6a6a69683b9686cc4d861a88566d4c4f71

SHA512
5a58fe0028a274999ed288adc9be7a584c1c76c2ef4dc3df6f44e67b9aeb475499135449c1ec9adf4ec2413dc4e6ec6d87ae2134311ccafd0ad75c0c44e8af70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3439787.exe
Filesize
305KB

MD5
a266b9b8ecb3ee0394b4287b24b42259

SHA1
32bacbfd2e17f7b514c3dc8791c0deed296d438f

SHA256
fca5220b9770970cae6b7472fcc1adf7d8740c1105851a2d28b4ee50fc77aebb

SHA512
bbfd210fdbe1d4730bee3c25d994a61a49d02bb06e3c47f9637930a25a66ada1107ce65edbb7f32457f21cb8ffac4bf01262daa1c66ac30d98e2659e4f96cd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3439787.exe
Filesize
305KB

MD5
a266b9b8ecb3ee0394b4287b24b42259

SHA1
32bacbfd2e17f7b514c3dc8791c0deed296d438f

SHA256
fca5220b9770970cae6b7472fcc1adf7d8740c1105851a2d28b4ee50fc77aebb

SHA512
bbfd210fdbe1d4730bee3c25d994a61a49d02bb06e3c47f9637930a25a66ada1107ce65edbb7f32457f21cb8ffac4bf01262daa1c66ac30d98e2659e4f96cd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3426371.exe
Filesize
185KB

MD5
7d2a4f1c088908e87dd8d7935cc6f094

SHA1
9cc267650862a01dfad47c00511e5e14e44e088f

SHA256
377e62d9d877e2fcfbcbb11a3f0b0e4e062574f57cc30f797b9f447b3104ec83

SHA512
a50460795e6764bd7d07a4e69bfcf579268063cd0885f9b62e4010ba219c6c807d234e478ab48dac61983b63cb413d31f545053df8c4840063bc886c215c5584

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3426371.exe
Filesize
185KB

MD5
7d2a4f1c088908e87dd8d7935cc6f094

SHA1
9cc267650862a01dfad47c00511e5e14e44e088f

SHA256
377e62d9d877e2fcfbcbb11a3f0b0e4e062574f57cc30f797b9f447b3104ec83

SHA512
a50460795e6764bd7d07a4e69bfcf579268063cd0885f9b62e4010ba219c6c807d234e478ab48dac61983b63cb413d31f545053df8c4840063bc886c215c5584

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7297900.exe
Filesize
145KB

MD5
c57b1dcdc09d6f2024fc7f879cada615

SHA1
9ca7169888f1284c856dbaa756c2e03baa9d7295

SHA256
ac01ff3025f6009bd8a5e84dea8bd605e2b63395c51ee79019afd935382641e0

SHA512
2fb459e80391e96fd23869b12665ba259a732c8bb5fae9f8166a5eb0a5a516107bc77fe75d1b43cdce9e5619ba742099d141673e33081b9050323c95efdceb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7297900.exe
Filesize
145KB

MD5
c57b1dcdc09d6f2024fc7f879cada615

SHA1
9ca7169888f1284c856dbaa756c2e03baa9d7295

SHA256
ac01ff3025f6009bd8a5e84dea8bd605e2b63395c51ee79019afd935382641e0

SHA512
2fb459e80391e96fd23869b12665ba259a732c8bb5fae9f8166a5eb0a5a516107bc77fe75d1b43cdce9e5619ba742099d141673e33081b9050323c95efdceb4f

Download Submit
memory/4460-199-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4460-196-0x0000000005640000-0x0000000005652000-memory.dmp

Filesize
72KB

Download
memory/4460-195-0x0000000005710000-0x000000000581A000-memory.dmp

Filesize
1.0MB

Download
memory/4460-194-0x0000000005B90000-0x00000000061A8000-memory.dmp

Filesize
6.1MB

Download
memory/4460-193-0x0000000000C70000-0x0000000000C9A000-memory.dmp

Filesize
168KB

Download
memory/4460-197-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/4460-198-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4840-173-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-187-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-171-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-167-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-175-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-177-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-179-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-181-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-183-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-185-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-186-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-169-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-188-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-165-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-163-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-161-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-159-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-158-0x0000000004F20000-0x0000000004F36000-memory.dmp

Filesize
88KB

Download
memory/4840-157-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-156-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-155-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4840-154-0x0000000004960000-0x0000000004F04000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads