redline | 70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5

General

Target

70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe
Size

1.1MB
MD5

498f359b8fdb99ef90b40ed13a0ff5b8
SHA1

13074fb5879450c99d9b044cc69089ab994eeb3e
SHA256

70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5
SHA512

5fc866bff925a9c3005f50d163ae67f6dfcfda0a49fb8b4084753d44ae19ca0ac06dad705025520786c84e11c3054fb92737673d0594da6d89f70522a3564030
SSDEEP

24576:byYQAnEMyKwuK9kg8s+/b0FkZgeyUwyy4tryvEBIfmleChx574:OYQjMyKwutBLj0FkZHI4trKEBIfs/hxd

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k4734783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4734783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4734783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4734783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4734783.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4734783.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ca6-54.dat	family_redline
behavioral1/memory/3480-56-0x0000000000DB0000-0x0000000000DDA000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
2944	y8386517.exe
3388	y9479962.exe
764	k4734783.exe
3480	l6623064.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4734783.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k4734783.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9479962.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8386517.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k4734783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l6623064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8386517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9479962.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	k4734783.exe
764	k4734783.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	k4734783.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2944	1848	70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe	84
PID 1848 wrote to memory of 2944	1848	70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe	84
PID 1848 wrote to memory of 2944	1848	70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe	84
PID 2944 wrote to memory of 3388	2944	y8386517.exe	85
PID 2944 wrote to memory of 3388	2944	y8386517.exe	85
PID 2944 wrote to memory of 3388	2944	y8386517.exe	85
PID 3388 wrote to memory of 764	3388	y9479962.exe	86
PID 3388 wrote to memory of 764	3388	y9479962.exe	86
PID 3388 wrote to memory of 764	3388	y9479962.exe	86
PID 3388 wrote to memory of 3480	3388	y9479962.exe	94
PID 3388 wrote to memory of 3480	3388	y9479962.exe	94
PID 3388 wrote to memory of 3480	3388	y9479962.exe	94

C:\Users\Admin\AppData\Local\Temp\70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe
"C:\Users\Admin\AppData\Local\Temp\70ea3087f786cdc34b96f79bb755230b6a735737a58a44f66ce28ae37e73beb5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8386517.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8386517.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9479962.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9479962.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4734783.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4734783.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:764
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6623064.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6623064.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8386517.exe

Filesize
748KB

MD5
63ef4e7c9718e462d81ca6c40e43c79e

SHA1
a2033e38874d73300503ff6701c7e063290c8520

SHA256
02185f857033739f5a0185dc9bf3f5287a2fc0f8571fad9750ce7e917733466c

SHA512
dfd1a7030704ed35e5e20194e804323b7ba92019f41b693b6fabba545236601d57926fd047f44cc058df67698c8d40db2b8c68d65c6d709d34179f3c04d0eaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9479962.exe

Filesize
304KB

MD5
03b382f504142a7d5e5a503bc3325369

SHA1
cf178713d8f9b3343c78f2c4d2593957b3ec05e6

SHA256
72c7376df8a6fabf73494e0ff7484ad295bf4b2c1fafa03ed3f92e97c804f61e

SHA512
d916510b404dbd6376af94af6f3d9b33a0932fe55aea8a263e94c2637e49750c7807617ae34f7236028ade972b0a34fc8e6ac28338e224f4d3fa18b11ab57ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4734783.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6623064.exe

Filesize
145KB

MD5
2fe3338edc0adacfe8a6c2f4d43446e0

SHA1
92dab655201f8e326630833dd7961e8046d05c04

SHA256
127c82e50c71985eb859991cab39f41fbb4834e5b1043e39379919445679dcc2

SHA512
8c54d558c816f14691ebef4905c1caaa3030002814e513268eb8c7779561754468a57265e7fec5776a965b7229378bd0787e845149b032798dce0d351f91f0d2

Download Submit
memory/764-49-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-51-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-22-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/764-47-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-45-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-43-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-41-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-23-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/764-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-29-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-24-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/764-21-0x00000000024B0000-0x00000000024CE000-memory.dmp

Filesize
120KB

Download
memory/3480-56-0x0000000000DB0000-0x0000000000DDA000-memory.dmp

Filesize
168KB

Download
memory/3480-57-0x0000000005BC0000-0x00000000061D8000-memory.dmp

Filesize
6.1MB

Download
memory/3480-58-0x0000000005740000-0x000000000584A000-memory.dmp

Filesize
1.0MB

Download
memory/3480-59-0x0000000005670000-0x0000000005682000-memory.dmp

Filesize
72KB

Download
memory/3480-60-0x00000000056D0000-0x000000000570C000-memory.dmp

Filesize
240KB

Download
memory/3480-61-0x0000000005850000-0x000000000589C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads