redline | 3d804f5d47b483b6628ba2c6c24da9d45473caecfe4c14261ed06dd099564bd4

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe
Size 488KB
Sample240513-m1nltabc2w
SHA256 40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df
MD5 14032c183d81576defd438b6463c9a49
SHA1 14456a767084e5ace931e0b6b0ada5cb328b713c
SHA512 a6517ca77c3b04a5ea68ddb09b5a6af0729020b5cb21bb1028360da3cdff712f91997a4ff23610e2076c1a4adf27efa7585e8bd8d5ef4eda4b8603a572860bc9
SSDEEP 12288:bMrUy909it2DZ8y4fYtpByKD8hbmPaDk:nycit2DZkfGByvhbmCDk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline mixa evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mixa

185.161.248.75:4132

Attributes

auth_value
9d14534b25ac495ab25b59800acf3bb2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6373783.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/1644-54-0x0000000000AB0000-0x0000000000ADE000-memory.dmp	family_redline
behavioral2/files/0x0007000000023469-53.dat	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2996	v2055717.exe
2780	a6373783.exe
1644	b8511563.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6373783.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2055717.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	a6373783.exe
2780	a6373783.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	a6373783.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2996	2648	40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe	83
PID 2648 wrote to memory of 2996	2648	40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe	83
PID 2648 wrote to memory of 2996	2648	40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe	83
PID 2996 wrote to memory of 2780	2996	v2055717.exe	84
PID 2996 wrote to memory of 2780	2996	v2055717.exe	84
PID 2996 wrote to memory of 2780	2996	v2055717.exe	84
PID 2996 wrote to memory of 1644	2996	v2055717.exe	96
PID 2996 wrote to memory of 1644	2996	v2055717.exe	96
PID 2996 wrote to memory of 1644	2996	v2055717.exe	96

C:\Users\Admin\AppData\Local\Temp\40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe
"C:\Users\Admin\AppData\Local\Temp\40b9f660e1bc8e8a4288c5658a5a7562a018017e0009a280ff5d16e68ace33df.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2055717.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2055717.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6373783.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6373783.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8511563.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8511563.exe
    3⤵
    - Executes dropped EXE
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v2055717.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2055717.exe
Size 316KB
SHA256 29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790
MD5 c1fa4d7116f1f4ed68bc4ede8f0d4324
SHA1 e53a72d74ed0a5cdcd25d31bc2587c47b473dba6
SHA512 e66d57fa6dd0e997f3f79860dd14773df52e9fa95194d63169b74b406e578b5e946c0627e39581fa122e48cf2fb6f773c447852b716e906d5e55922c751ed99e
SSDEEP 6144:Kgy+bnr+Fp0yN90QEQ6vZrMgXGma0+qSNF1liaHp7Z76:AMrZy90SmNRGfNTpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6373783.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6373783.exe
Size 184KB
SHA256 a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b
MD5 d4c640fb500618ad6c9fc5fe7d3e784d
SHA1 850df0880e1685ce709b44afbbb365cab4f0fec4
SHA512 a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd
SSDEEP 3072:1DKW1LgppLRHMY0TBfJvjcTp5XmvTJT00K9ItKcHxaAixOiw:1DKW1Lgbdl0TBBvjc/mvTJKmjxue
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8511563.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8511563.exe
Size 168KB
SHA256 134c50b335f3a098e45b95acb8a1763a881c50be9e3a2d1a3b31d5c73bf1e0e0
MD5 691065d262560dc4ff58d3a64412002a
SHA1 e0a94d94cdecb4768915e338b7cab9a57ef3c965
SHA512 9116086eccb13c601c0a2cb386346a468817d26ccd74050e72c3c70731830d0782941d720cdfbc00f2d3fcd3320137f8ac33d83b9fd18f34fec32c7d16d88f59
SSDEEP 3072:8kmfv4r8W2qTvI2t2qVwoMTOIkvl98e8hg:gfvhZ/Rfkvl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1644-60-0x00000000054E0000-0x000000000552C000-memory.dmp

Download

memory/1644-57-0x0000000005570000-0x000000000567A000-memory.dmp

Download

memory/1644-59-0x00000000054A0000-0x00000000054DC000-memory.dmp

Download

memory/1644-58-0x0000000005420000-0x0000000005432000-memory.dmp

Download

memory/1644-56-0x0000000005A80000-0x0000000006098000-memory.dmp

Download

memory/1644-55-0x0000000002D20000-0x0000000002D26000-memory.dmp

Download

memory/1644-54-0x0000000000AB0000-0x0000000000ADE000-memory.dmp

Download

memory/2780-28-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-21-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-40-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-38-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-34-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-30-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-44-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-26-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-25-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-22-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-36-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-42-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-20-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2780-19-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2780-50-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2780-46-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-48-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-32-0x0000000004AF0000-0x0000000004B06000-memory.dmp

Download

memory/2780-16-0x0000000004CC0000-0x0000000005264000-memory.dmp

Download

memory/2780-17-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2780-18-0x0000000004AF0000-0x0000000004B0C000-memory.dmp

Download

memory/2780-15-0x00000000007B0000-0x00000000007CE000-memory.dmp

Download

memory/2780-14-0x00000000745CE000-0x00000000745CF000-memory.dmp

Download