redline | 417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f

General

Target

417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe
Size

1.1MB
MD5

4858809d2214028e467e69af9992ca54
SHA1

dee1decd188e5adadf5d513cc323898ea8b19f7d
SHA256

417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f
SHA512

1725da271ea138cff7bd28f3b0f2e418d29ff54d15cbfc9c206b9d33c31f4095fe08ce6c573af17fd3b14b5f3ee49f8265c70fc49deb02c79e2ac17cf7aa3fd6
SSDEEP

24576:BynczzQRTElg94pG0DR6hNLjXvbUe70l/BLemEmO3:0nszQRTElg9EGYaN7ZGBLemEm

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3565550.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3565550.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k3565550.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3565550.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3565550.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3565550.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b78-54.dat	family_redline
behavioral1/memory/3784-56-0x0000000000230000-0x000000000025A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
1348	y3495134.exe
620	y7434347.exe
3596	k3565550.exe
3784	l0259299.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k3565550.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3565550.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3495134.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7434347.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3495134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y7434347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3565550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l0259299.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	k3565550.exe
3596	k3565550.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	k3565550.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 1348	3120	417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe	84
PID 3120 wrote to memory of 1348	3120	417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe	84
PID 3120 wrote to memory of 1348	3120	417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe	84
PID 1348 wrote to memory of 620	1348	y3495134.exe	85
PID 1348 wrote to memory of 620	1348	y3495134.exe	85
PID 1348 wrote to memory of 620	1348	y3495134.exe	85
PID 620 wrote to memory of 3596	620	y7434347.exe	86
PID 620 wrote to memory of 3596	620	y7434347.exe	86
PID 620 wrote to memory of 3596	620	y7434347.exe	86
PID 620 wrote to memory of 3784	620	y7434347.exe	95
PID 620 wrote to memory of 3784	620	y7434347.exe	95
PID 620 wrote to memory of 3784	620	y7434347.exe	95

C:\Users\Admin\AppData\Local\Temp\417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe
"C:\Users\Admin\AppData\Local\Temp\417f0df14ed54df4d6abe47c52b710cfcbad13b10241fe140b69d2529326597f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3495134.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3495134.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7434347.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7434347.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3565550.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3565550.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0259299.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0259299.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3495134.exe

Filesize
749KB

MD5
27458202cc1917d6c02f938ea048b4a9

SHA1
143142731eee555513a6412018b5ee0112bcae3b

SHA256
e243033e5e5f96218b8760c3fa2d17124e8edb2bee244226f92fe8bfcae884f0

SHA512
9134d9864f7c51907a989a88a34399b707104bf66520f77423ad53548cc75a5f456978899f22aacac54d2d919084940a56357a87fd46585c972e3d4a64545f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7434347.exe

Filesize
305KB

MD5
aae5df990ddbd61dd6836b1c33937f0b

SHA1
219d38d3b736631e9e0dd45653186ef5be9fd461

SHA256
d3c4eb5cdcb0cea360727ccb097b5e7a22dc5221b0e6494cc864876e62bc729e

SHA512
add5577d61122370edd0bc3f8f262a36df034afc64ebf0a3d6aca323d15091d0935729e3aaa9dbdfd5699012ba8156eb079b4c5a7700e6ae4b31e31b04d571a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3565550.exe

Filesize
183KB

MD5
d18dd7e957d8eab39abe21eefd498331

SHA1
2d7b11252dbb1ed8cefff8d63d447b0f697a0060

SHA256
57f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440

SHA512
c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0259299.exe

Filesize
145KB

MD5
1aa5ddb1640ed73f5bdd122eb31116d2

SHA1
8f8a5376d259c118d7724cabc6abe68d9b48a36e

SHA256
76e380fd5e86e1000117e7609840b8e8f772fa33b1365ef8bb3d2c8b4ce7db90

SHA512
e1e1b71226d2423809a956b32d8b80887cfa37a1bd10ecd1e58bb55833c3c1bef55579f7b4b65e037662b5c98f336e5778e50b7c581832b6359ebdf38db24d37

Download Submit
memory/3596-51-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-35-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-29-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-22-0x0000000004D10000-0x00000000052B4000-memory.dmp

Filesize
5.6MB

Download
memory/3596-49-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-47-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-45-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-43-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-41-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-39-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-37-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-23-0x0000000002780000-0x000000000279C000-memory.dmp

Filesize
112KB

Download
memory/3596-33-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-31-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-27-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-25-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-24-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3596-21-0x00000000022B0000-0x00000000022CE000-memory.dmp

Filesize
120KB

Download
memory/3784-56-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/3784-57-0x0000000005180000-0x0000000005798000-memory.dmp

Filesize
6.1MB

Download
memory/3784-58-0x0000000004D00000-0x0000000004E0A000-memory.dmp

Filesize
1.0MB

Download
memory/3784-59-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3784-60-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

Filesize
240KB

Download
memory/3784-61-0x0000000004E10000-0x0000000004E5C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads