redline | 4d84a8443fa38a0e67764103a311bf6a6a69683b9686cc4d861a88566d4c4f71

General

Target

v5084366.exe
Size

749KB
MD5

d13cdcc7a3e4b53c6353806332e2a38c
SHA1

3c077fca0e2c0164d0b3e64bf736ff657617eb64
SHA256

4d84a8443fa38a0e67764103a311bf6a6a69683b9686cc4d861a88566d4c4f71
SHA512

5a58fe0028a274999ed288adc9be7a584c1c76c2ef4dc3df6f44e67b9aeb475499135449c1ec9adf4ec2413dc4e6ec6d87ae2134311ccafd0ad75c0c44e8af70
SSDEEP

12288:RMrMy90V4IbzNlS1XPir2vE3tknE7xwgT/L8hjAog2vr+YAbYb:5yg4IvvStqavOknsq6j8yogYr/AM

Score

10^/10

redline maxi evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19062

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

a3426371.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3426371.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 3 IoCs

Processes:

v3439787.exea3426371.exeb7297900.exe

pid process

1228 v3439787.exe
4876 a3426371.exe
392 b7297900.exe

pid	process
1228	v3439787.exe
4876	a3426371.exe
392	b7297900.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

a3426371.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a3426371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3426371.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

v5084366.exev3439787.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5084366.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	v5084366.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v3439787.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3439787.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3426371.exe

pid process

4876 a3426371.exe
4876 a3426371.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3426371.exe

description pid process

Token: SeDebugPrivilege 4876 a3426371.exe

pid	process
4876	a3426371.exe
4876	a3426371.exe

description	pid	process
Token: SeDebugPrivilege	4876	a3426371.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

v5084366.exev3439787.exe

description	pid	process	target process
PID 1256 wrote to memory of 1228	1256	v5084366.exe	v3439787.exe
PID 1256 wrote to memory of 1228	1256	v5084366.exe	v3439787.exe
PID 1256 wrote to memory of 1228	1256	v5084366.exe	v3439787.exe
PID 1228 wrote to memory of 4876	1228	v3439787.exe	a3426371.exe
PID 1228 wrote to memory of 4876	1228	v3439787.exe	a3426371.exe
PID 1228 wrote to memory of 4876	1228	v3439787.exe	a3426371.exe
PID 1228 wrote to memory of 392	1228	v3439787.exe	b7297900.exe
PID 1228 wrote to memory of 392	1228	v3439787.exe	b7297900.exe
PID 1228 wrote to memory of 392	1228	v3439787.exe	b7297900.exe

C:\Users\Admin\AppData\Local\Temp\v5084366.exe
"C:\Users\Admin\AppData\Local\Temp\v5084366.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3439787.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3439787.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3426371.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3426371.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7297900.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7297900.exe
3⤵
- Executes dropped EXE
PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3439787.exe
Filesize
305KB

MD5
a266b9b8ecb3ee0394b4287b24b42259

SHA1
32bacbfd2e17f7b514c3dc8791c0deed296d438f

SHA256
fca5220b9770970cae6b7472fcc1adf7d8740c1105851a2d28b4ee50fc77aebb

SHA512
bbfd210fdbe1d4730bee3c25d994a61a49d02bb06e3c47f9637930a25a66ada1107ce65edbb7f32457f21cb8ffac4bf01262daa1c66ac30d98e2659e4f96cd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3439787.exe
Filesize
305KB

MD5
a266b9b8ecb3ee0394b4287b24b42259

SHA1
32bacbfd2e17f7b514c3dc8791c0deed296d438f

SHA256
fca5220b9770970cae6b7472fcc1adf7d8740c1105851a2d28b4ee50fc77aebb

SHA512
bbfd210fdbe1d4730bee3c25d994a61a49d02bb06e3c47f9637930a25a66ada1107ce65edbb7f32457f21cb8ffac4bf01262daa1c66ac30d98e2659e4f96cd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3426371.exe
Filesize
185KB

MD5
7d2a4f1c088908e87dd8d7935cc6f094

SHA1
9cc267650862a01dfad47c00511e5e14e44e088f

SHA256
377e62d9d877e2fcfbcbb11a3f0b0e4e062574f57cc30f797b9f447b3104ec83

SHA512
a50460795e6764bd7d07a4e69bfcf579268063cd0885f9b62e4010ba219c6c807d234e478ab48dac61983b63cb413d31f545053df8c4840063bc886c215c5584

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3426371.exe
Filesize
185KB

MD5
7d2a4f1c088908e87dd8d7935cc6f094

SHA1
9cc267650862a01dfad47c00511e5e14e44e088f

SHA256
377e62d9d877e2fcfbcbb11a3f0b0e4e062574f57cc30f797b9f447b3104ec83

SHA512
a50460795e6764bd7d07a4e69bfcf579268063cd0885f9b62e4010ba219c6c807d234e478ab48dac61983b63cb413d31f545053df8c4840063bc886c215c5584

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7297900.exe
Filesize
145KB

MD5
c57b1dcdc09d6f2024fc7f879cada615

SHA1
9ca7169888f1284c856dbaa756c2e03baa9d7295

SHA256
ac01ff3025f6009bd8a5e84dea8bd605e2b63395c51ee79019afd935382641e0

SHA512
2fb459e80391e96fd23869b12665ba259a732c8bb5fae9f8166a5eb0a5a516107bc77fe75d1b43cdce9e5619ba742099d141673e33081b9050323c95efdceb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7297900.exe
Filesize
145KB

MD5
c57b1dcdc09d6f2024fc7f879cada615

SHA1
9ca7169888f1284c856dbaa756c2e03baa9d7295

SHA256
ac01ff3025f6009bd8a5e84dea8bd605e2b63395c51ee79019afd935382641e0

SHA512
2fb459e80391e96fd23869b12665ba259a732c8bb5fae9f8166a5eb0a5a516107bc77fe75d1b43cdce9e5619ba742099d141673e33081b9050323c95efdceb4f

Download Submit
memory/392-187-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/392-186-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/392-188-0x0000000004F50000-0x0000000004F8C000-memory.dmp

Filesize
240KB

Download
memory/392-185-0x0000000004E40000-0x0000000004F4A000-memory.dmp

Filesize
1.0MB

Download
memory/392-184-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/392-183-0x00000000004E0000-0x000000000050A000-memory.dmp

Filesize
168KB

Download
memory/392-189-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/4876-150-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-178-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4876-166-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-168-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-170-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-172-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-174-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-176-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-177-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4876-164-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-162-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-160-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-158-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-156-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-154-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-152-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-149-0x0000000004960000-0x0000000004976000-memory.dmp

Filesize
88KB

Download
memory/4876-148-0x00000000049B0000-0x0000000004F54000-memory.dmp

Filesize
5.6MB

Download
memory/4876-147-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads