redline | 3d804f5d47b483b6628ba2c6c24da9d45473caecfe4c14261ed06dd099564bd4

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe
Size 488KB
Sample240513-m1nltabc2w
SHA256 760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788
MD5 0bc4d4955a5cff8e22ddebc42c7ba5df
SHA1 c75a3645136398ea851f6d5dbf80236875e6a2fc
SHA512 04761e08d144fa3ce5ed2c64f109065414ad4c607e61b3f854b986e15e81341958aafefc6d4aa85d997be35edc4494cc524f537c00bcf332b1b5a402eb663ca8
SSDEEP 6144:Kvy+bnr+cp0yN90QEamkThp1LQSDFNhG7dCsPT1uce0Kb1E8OBR2KaJV8f3xZ1RC:dMrUy904tplNGh1PIczKlOHZang1RQ3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline debro evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

debro

185.161.248.75:4132

Attributes

auth_value
18c2c191aebfde5d1787ec8d805a01a8

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0214237.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0214237.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0214237.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0214237.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0214237.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0214237.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/files/0x000700000002342a-52.dat	family_redline
behavioral7/memory/4364-54-0x0000000000C40000-0x0000000000C6E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
1796	y4130998.exe
2280	k0214237.exe
4364	l3041907.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0214237.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0214237.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4130998.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2280	k0214237.exe
2280	k0214237.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	k0214237.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1796	224	760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe	82
PID 224 wrote to memory of 1796	224	760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe	82
PID 224 wrote to memory of 1796	224	760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe	82
PID 1796 wrote to memory of 2280	1796	y4130998.exe	84
PID 1796 wrote to memory of 2280	1796	y4130998.exe	84
PID 1796 wrote to memory of 2280	1796	y4130998.exe	84
PID 1796 wrote to memory of 4364	1796	y4130998.exe	89
PID 1796 wrote to memory of 4364	1796	y4130998.exe	89
PID 1796 wrote to memory of 4364	1796	y4130998.exe	89

C:\Users\Admin\AppData\Local\Temp\760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe
"C:\Users\Admin\AppData\Local\Temp\760ff82affdc0e606cfbb29a4342fb530b00a718d6b76fc91c9334e1450a7788.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4130998.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4130998.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0214237.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0214237.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3041907.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3041907.exe
    3⤵
    - Executes dropped EXE
    PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y4130998.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4130998.exe
Size 316KB
SHA256 17fde5d9ca56c86f7c55a06c86a5f499da4e8be448da902e8bca4b6a2ab62037
MD5 700ae249a1b5335cd43a6f464e36e5b1
SHA1 4c23d7d927b6ae4eca55224a77c65e73561140e4
SHA512 48f502da66c47d0a81f0170cf5e4e11e2d496db9fedea3edccedf4711197afde1e63889bc48d82e0fea594af03842160bd3bf57c7f60d399ef26547203ed48a3
SSDEEP 6144:KEy+bnr+Rp0yN90QEh6vZrMgX3eYK41E8OBURKaJct:MMrJy903mN3rKWOmEaet
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0214237.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0214237.exe
Size 184KB
SHA256 a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b
MD5 d4c640fb500618ad6c9fc5fe7d3e784d
SHA1 850df0880e1685ce709b44afbbb365cab4f0fec4
SHA512 a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd
SSDEEP 3072:1DKW1LgppLRHMY0TBfJvjcTp5XmvTJT00K9ItKcHxaAixOiw:1DKW1Lgbdl0TBBvjc/mvTJKmjxue
MD5 SHA1 SHA512 SSDEEP

Submit Download

l3041907.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3041907.exe
Size 168KB
SHA256 2b4b4763e6bbb8543af9e782c113f7a291ba48bb45750f41c51d7b7718e95b96
MD5 4e7dfee1c2504bcf18c77c93c5b4ff25
SHA1 de11afdbc2a0054329c3be4b381d312b3c6ca3ff
SHA512 18fa3a5fba9c0242e04b799296386c21cc59dc49e867ea7224371b3bac66e09b52c59a9e70d8b2331893b091a6001de99c586651fd16355ada48d0f0b9327ab6
SSDEEP 1536:/9OLnP5teqhVZCGW5WwPwf8WTaj3zJJeunCxwSTGqVS5Wbu1RGwqHd384wYkp8eK:/8T3Ei8Wej9gWqVSYQRqHd388e8h3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-34-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-20-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/2280-16-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/2280-18-0x0000000004F50000-0x0000000004F6C000-memory.dmp

Download

memory/2280-19-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/2280-21-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-40-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-48-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-46-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-44-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-42-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-38-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-36-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-15-0x00000000022D0000-0x00000000022EE000-memory.dmp

Download

memory/2280-17-0x0000000004950000-0x0000000004EF4000-memory.dmp

Download

memory/2280-32-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-14-0x000000007402E000-0x000000007402F000-memory.dmp

Download

memory/2280-26-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-24-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-22-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-30-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/2280-50-0x0000000074020000-0x00000000747D0000-memory.dmp

Download

memory/2280-28-0x0000000004F50000-0x0000000004F66000-memory.dmp

Download

memory/4364-54-0x0000000000C40000-0x0000000000C6E000-memory.dmp

Download

memory/4364-55-0x0000000001400000-0x0000000001406000-memory.dmp

Download

memory/4364-56-0x000000000B130000-0x000000000B748000-memory.dmp

Download

memory/4364-57-0x000000000AC20000-0x000000000AD2A000-memory.dmp

Download

memory/4364-58-0x000000000AB30000-0x000000000AB42000-memory.dmp

Download

memory/4364-59-0x000000000AB90000-0x000000000ABCC000-memory.dmp

Download

memory/4364-60-0x0000000004E50000-0x0000000004E9C000-memory.dmp

Download