redline | b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe
Size 883KB
Sample241104-rbq3vs1apg
SHA256 b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5
MD5 6315ff5997f40db6e7c02f0e2591c41d
SHA1 82829b5f4b99eb0ef813b80b38b51c57ec58ccc9
SHA512 41c1c5a72f02d5c188d7f66e8f21526805b8f62939b4ba1068814359e3458cdb54e36995a601b5731517f695b063bd90f0cf224afdc672ef27f2c22c448a3250
SSDEEP 12288:nMrPy90TXfzH/hODiZHPJaNkpwao6OUmpXwNjaFd8kYM/N+CQ:MySrhO2HhaswV2aXF8d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline mixa discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mixa

185.161.248.75:4132

Attributes

auth_value
9d14534b25ac495ab25b59800acf3bb2

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5470447.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5470447.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5470447.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5470447.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5470447.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5470447.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000023bbf-54.dat	family_redline
behavioral1/memory/4008-56-0x0000000000FA0000-0x0000000000FCE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4488	v5988259.exe
4588	v9334046.exe
2260	a5470447.exe
4008	b8034996.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5470447.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5470447.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5988259.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9334046.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5988259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9334046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5470447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8034996.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	a5470447.exe
2260	a5470447.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	a5470447.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4488	4716	b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe	84
PID 4716 wrote to memory of 4488	4716	b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe	84
PID 4716 wrote to memory of 4488	4716	b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe	84
PID 4488 wrote to memory of 4588	4488	v5988259.exe	85
PID 4488 wrote to memory of 4588	4488	v5988259.exe	85
PID 4488 wrote to memory of 4588	4488	v5988259.exe	85
PID 4588 wrote to memory of 2260	4588	v9334046.exe	86
PID 4588 wrote to memory of 2260	4588	v9334046.exe	86
PID 4588 wrote to memory of 2260	4588	v9334046.exe	86
PID 4588 wrote to memory of 4008	4588	v9334046.exe	95
PID 4588 wrote to memory of 4008	4588	v9334046.exe	95
PID 4588 wrote to memory of 4008	4588	v9334046.exe	95

C:\Users\Admin\AppData\Local\Temp\b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe
"C:\Users\Admin\AppData\Local\Temp\b52d92b0152c8612d32c2cef9ae32f776d3432869bed44c3ef0858fbb1a489f5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5988259.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5988259.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9334046.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9334046.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5470447.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5470447.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8034996.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8034996.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v5988259.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5988259.exe
Size 488KB
SHA256 c30b212437a6d9a036572b3e1cf6122209d7c04a85efcd29868cda664aa39589
MD5 7561d3510348ae9aef609db0707a02c8
SHA1 b3edc5576d040d65de03b79d29b3e86a7bc3c7f6
SHA512 70013f3c7acdace64e6338956d5a6ab9f4e1063ba7632af470b1ca4c1f1ae0e73d8f5c672f5e389e971278ddeca327be70dc7c9c3b6e68296cc4ee9f00efd15c
SSDEEP 12288:UMrIy90qzScoJqeogIfHHe4fNjpKpvCOFmE:syicWogyHxfDK1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9334046.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9334046.exe
Size 316KB
SHA256 eb500b34c91d1c6ff57d41ec8f7b323b2db6b1ab586db2a2f98b6955ed6ef510
MD5 037e00398428b8e0f5ea918e8e457503
SHA1 2e8ab9aa524c9a9fd4c89cc7f0c478d7f25a361b
SHA512 517d659a99f5ae64e7368bdb1c4b406c6b54db4b6b9048501f8a5ac224c1c96f21f169f18cb29a692813fa81a6e319394edc4f31e402dc490880cd3e7aa5da50
SSDEEP 6144:KTy+bnr+5p0yN90QEU6vZrMgXGma0+qSNF1liSHp7Z76:JMr1y90GmNRGfNjp0
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5470447.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5470447.exe
Size 184KB
SHA256 a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b
MD5 d4c640fb500618ad6c9fc5fe7d3e784d
SHA1 850df0880e1685ce709b44afbbb365cab4f0fec4
SHA512 a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd
SSDEEP 3072:1DKW1LgppLRHMY0TBfJvjcTp5XmvTJT00K9ItKcHxaAixOiw:1DKW1Lgbdl0TBBvjc/mvTJKmjxue
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8034996.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8034996.exe
Size 168KB
SHA256 65b6d0007b927cc54cd1a3417b9a307bc5597d66ecaad5a79b6b35df47ff9def
MD5 2a649018dcf097ba9313918b3d6a03dc
SHA1 f83ab0eaee43dc473d62e68fb7faad6d41bc2902
SHA512 033cd74416b0867f11a25a78a5e3092b0d94c61dedd21de80f5a05d2ab37febef1d28f04741185d031e5aa4842a3e7ee674c86e715929473dd088dce42b56158
SSDEEP 3072:8kmfv4r8W2qTvI2t2qVwoMTOIkvl98e8hg:gfvhZ/Rfkvl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2260-49-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-29-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-51-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-22-0x0000000004AA0000-0x0000000005044000-memory.dmp

Download

memory/2260-47-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-45-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-43-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-42-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-39-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-38-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-35-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-33-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-31-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-23-0x0000000005090000-0x00000000050AC000-memory.dmp

Download

memory/2260-27-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-25-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-24-0x0000000005090000-0x00000000050A6000-memory.dmp

Download

memory/2260-21-0x0000000002300000-0x000000000231E000-memory.dmp

Download

memory/4008-56-0x0000000000FA0000-0x0000000000FCE000-memory.dmp

Download

memory/4008-57-0x0000000003150000-0x0000000003156000-memory.dmp

Download

memory/4008-58-0x000000000B2F0000-0x000000000B908000-memory.dmp

Download

memory/4008-59-0x000000000AE10000-0x000000000AF1A000-memory.dmp

Download

memory/4008-60-0x000000000AD40000-0x000000000AD52000-memory.dmp

Download

memory/4008-61-0x000000000ADA0000-0x000000000ADDC000-memory.dmp

Download

memory/4008-62-0x00000000052A0000-0x00000000052EC000-memory.dmp

Download