redline | 15da805913716df9c587eca175c626571489f023cb679b69ed646c3e95ab5567

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe
Size

316KB
MD5

c1fa4d7116f1f4ed68bc4ede8f0d4324
SHA1

e53a72d74ed0a5cdcd25d31bc2587c47b473dba6
SHA256

29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790
SHA512

e66d57fa6dd0e997f3f79860dd14773df52e9fa95194d63169b74b406e578b5e946c0627e39581fa122e48cf2fb6f773c447852b716e906d5e55922c751ed99e
SSDEEP

6144:Kgy+bnr+Fp0yN90QEQ6vZrMgXGma0+qSNF1liaHp7Z76:AMrZy90SmNRGfNTpM

Score

10^/10

redline mixa evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mixa

185.161.248.75:4132

Attributes

auth_value
9d14534b25ac495ab25b59800acf3bb2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6373783.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x0007000000023406-44.dat	family_redline
behavioral5/memory/3920-47-0x0000000000D90000-0x0000000000DBE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
932	a6373783.exe
3920	b8511563.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6373783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6373783.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
932	a6373783.exe
932	a6373783.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	a6373783.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 932	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	81
PID 460 wrote to memory of 932	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	81
PID 460 wrote to memory of 932	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	81
PID 460 wrote to memory of 3920	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	87
PID 460 wrote to memory of 3920	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	87
PID 460 wrote to memory of 3920	460	29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe	87

C:\Users\Admin\AppData\Local\Temp\29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe
"C:\Users\Admin\AppData\Local\Temp\29458026160d87414595e05c8bdd81a3b5dd948821f3acc4531a2399f9572790.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6373783.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6373783.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b8511563.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b8511563.exe
  2⤵
  - Executes dropped EXE
  PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6373783.exe

Filesize
184KB

MD5
d4c640fb500618ad6c9fc5fe7d3e784d

SHA1
850df0880e1685ce709b44afbbb365cab4f0fec4

SHA256
a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b

SHA512
a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b8511563.exe

Filesize
168KB

MD5
691065d262560dc4ff58d3a64412002a

SHA1
e0a94d94cdecb4768915e338b7cab9a57ef3c965

SHA256
134c50b335f3a098e45b95acb8a1763a881c50be9e3a2d1a3b31d5c73bf1e0e0

SHA512
9116086eccb13c601c0a2cb386346a468817d26ccd74050e72c3c70731830d0782941d720cdfbc00f2d3fcd3320137f8ac33d83b9fd18f34fec32c7d16d88f59

Download Submit
memory/932-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-9-0x0000000074200000-0x00000000749B0000-memory.dmp

Filesize
7.7MB

Download
memory/932-21-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-17-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-40-0x0000000074200000-0x00000000749B0000-memory.dmp

Filesize
7.7MB

Download
memory/932-8-0x00000000024B0000-0x00000000024CE000-memory.dmp

Filesize
120KB

Download
memory/932-19-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-29-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-13-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-15-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-23-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-11-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/932-10-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/932-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-12-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/932-41-0x0000000074200000-0x00000000749B0000-memory.dmp

Filesize
7.7MB

Download
memory/932-43-0x0000000074200000-0x00000000749B0000-memory.dmp

Filesize
7.7MB

Download
memory/932-7-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/3920-47-0x0000000000D90000-0x0000000000DBE000-memory.dmp

Filesize
184KB

Download
memory/3920-48-0x00000000741B0000-0x000000007425B000-memory.dmp

Filesize
684KB

Download
memory/3920-49-0x0000000003080000-0x0000000003086000-memory.dmp

Filesize
24KB

Download
memory/3920-50-0x0000000005D20000-0x0000000006338000-memory.dmp

Filesize
6.1MB

Download
memory/3920-51-0x0000000005810000-0x000000000591A000-memory.dmp

Filesize
1.0MB

Download
memory/3920-52-0x00000000741B0000-0x000000007425B000-memory.dmp

Filesize
684KB

Download
memory/3920-53-0x0000000005720000-0x0000000005732000-memory.dmp

Filesize
72KB

Download
memory/3920-54-0x0000000005780000-0x00000000057BC000-memory.dmp

Filesize
240KB

Download
memory/3920-55-0x00000000057C0000-0x000000000580C000-memory.dmp

Filesize
304KB

Download
memory/3920-56-0x00000000741B0000-0x000000007425B000-memory.dmp

Filesize
684KB

Download