redline | c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5

General

Target

c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe
Size

1.1MB
MD5

a78c8949f2bd849c621263b0bc6f2fb0
SHA1

7d3c379dd15fd9f09c0ddd40139c03fafbf65e29
SHA256

c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5
SHA512

5484002a5094bcb1c3283a3db9a52c5c0ff5f01a1eed78d358b69ea7d54198f4892b7f53782152c7a5fd909f4f94ec990a24b6b6739bda71cd40a17a1d93a334
SSDEEP

24576:IyKaTofEyYZYkFk8Yuar5S1t/d5FWxm3yESRGzV4+6YRm:PKadvZYkFk8YSjVMmiESRF+BR

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6972432.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6972432.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6972432.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6972432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6972432.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6972432.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b6d-54.dat	family_redline
behavioral1/memory/4852-56-0x00000000006F0000-0x000000000071A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
3492	y8164162.exe
3964	y8319858.exe
1400	k6972432.exe
4852	l3905038.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6972432.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6972432.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8164162.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8319858.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8164162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8319858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k6972432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3905038.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	k6972432.exe
1400	k6972432.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	k6972432.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3492	224	c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe	84
PID 224 wrote to memory of 3492	224	c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe	84
PID 224 wrote to memory of 3492	224	c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe	84
PID 3492 wrote to memory of 3964	3492	y8164162.exe	85
PID 3492 wrote to memory of 3964	3492	y8164162.exe	85
PID 3492 wrote to memory of 3964	3492	y8164162.exe	85
PID 3964 wrote to memory of 1400	3964	y8319858.exe	86
PID 3964 wrote to memory of 1400	3964	y8319858.exe	86
PID 3964 wrote to memory of 1400	3964	y8319858.exe	86
PID 3964 wrote to memory of 4852	3964	y8319858.exe	94
PID 3964 wrote to memory of 4852	3964	y8319858.exe	94
PID 3964 wrote to memory of 4852	3964	y8319858.exe	94

C:\Users\Admin\AppData\Local\Temp\c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe
"C:\Users\Admin\AppData\Local\Temp\c184cab6a9f48a02334fd3abdfba8ff9b63e53fb573972db063678724b1900e5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8164162.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8164162.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8319858.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8319858.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6972432.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6972432.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3905038.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3905038.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8164162.exe

Filesize
749KB

MD5
08782d1206eabb3faf644bbb0ed9ab18

SHA1
6e1d59db265f872ecb3d8cdb8e234e60f654662e

SHA256
8a6ce38b6b81257626495d1613fa7f9c30873d4d746a5a2e1d14606a61971126

SHA512
3faebd72def82a9ad7d660b7890e5f0812231b004f55d3236beabd226b6d8dc7a272c5fe0c3a4075c686f477d404d40ae4f35298ae7fbdf1baf5ba4284ae9e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8319858.exe

Filesize
304KB

MD5
98f1f399b40400b63a3ec0a946f960f9

SHA1
1d91f63c7e568a48a21e4049d86a71b385b737aa

SHA256
74427ee845d786f5d7f62a5c47c2430bc935ba6c8bbeb3b55a327f5c7c3c08d7

SHA512
3219779bfd3f7cda423c61484eb236f5557a55d253d8d23fa6a735be83319e3accd1e24f84c06a7260c7a83c7f919701e6731ff0b29057c8b22f983ed8ec0610

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6972432.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3905038.exe

Filesize
145KB

MD5
72ce9e8dcd8d35ce0e01044e24385308

SHA1
7d3af9959e5ca732a83971c0ad1acddd8fc56dd2

SHA256
4f19131feedc1cf17d9a751ce682010da686db4b9a9014f6f4e376a549ac4aaa

SHA512
e65751fdcd1b2b68cf3631d8e8c3d8ca0fc9f55bf1b75507f539ab9c0e0df0254ff2513df68a2ecb3cb9b12fb59da3bb2c751abc7983cad4977be7d2f82928c5

Download Submit
memory/1400-31-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-35-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-27-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-22-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/1400-49-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-47-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-45-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-44-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-41-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-39-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-37-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-23-0x0000000004F50000-0x0000000004F6C000-memory.dmp

Filesize
112KB

Download
memory/1400-33-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-30-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-25-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-24-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-51-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/1400-21-0x00000000022A0000-0x00000000022BE000-memory.dmp

Filesize
120KB

Download
memory/4852-56-0x00000000006F0000-0x000000000071A000-memory.dmp

Filesize
168KB

Download
memory/4852-57-0x0000000005510000-0x0000000005B28000-memory.dmp

Filesize
6.1MB

Download
memory/4852-58-0x0000000005080000-0x000000000518A000-memory.dmp

Filesize
1.0MB

Download
memory/4852-59-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

Filesize
72KB

Download
memory/4852-60-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/4852-61-0x0000000005190000-0x00000000051DC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads