redline | c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86

General

Target

c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe
Size

1.1MB
MD5

4d6fdb88a47a4913b3adbd3bd6af2e87
SHA1

503873036640ce4be13ecbd76025964faf3c80bd
SHA256

c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86
SHA512

d251041c298573fb25ab19e1547c4dd5f995157b892d5373827acb18efd560431ad5e722f6f9630e34c88f8eed373349466a7c6c3a9effa9ca37082b5bf09b66
SSDEEP

24576:vyp0joChH9GTselEZg9POiDVRRk4zWj8kP8t3iHr6+WlY:6pM5hUTdEZg9PVVRO4Sj8S8tSL6d

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k6478574.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6478574.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6478574.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6478574.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6478574.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6478574.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6478574.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0007000000023ca4-54.dat	family_redline
behavioral1/memory/4468-56-0x0000000000ED0000-0x0000000000EFA000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

Processes:

y9785574.exey3651715.exek6478574.exel2230368.exe

pid	Process
3316	y9785574.exe
3136	y3651715.exe
3572	k6478574.exe
4468	l2230368.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k6478574.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6478574.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6478574.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exey9785574.exey3651715.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9785574.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y3651715.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exey9785574.exey3651715.exek6478574.exel2230368.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9785574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3651715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k6478574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2230368.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k6478574.exe

pid	Process
3572	k6478574.exe
3572	k6478574.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k6478574.exe

description	pid	Process
Token: SeDebugPrivilege	3572	k6478574.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exey9785574.exey3651715.exe

description	pid	Process	procid_target
PID 4832 wrote to memory of 3316	4832	c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe	84
PID 4832 wrote to memory of 3316	4832	c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe	84
PID 4832 wrote to memory of 3316	4832	c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe	84
PID 3316 wrote to memory of 3136	3316	y9785574.exe	86
PID 3316 wrote to memory of 3136	3316	y9785574.exe	86
PID 3316 wrote to memory of 3136	3316	y9785574.exe	86
PID 3136 wrote to memory of 3572	3136	y3651715.exe	87
PID 3136 wrote to memory of 3572	3136	y3651715.exe	87
PID 3136 wrote to memory of 3572	3136	y3651715.exe	87
PID 3136 wrote to memory of 4468	3136	y3651715.exe	96
PID 3136 wrote to memory of 4468	3136	y3651715.exe	96
PID 3136 wrote to memory of 4468	3136	y3651715.exe	96

C:\Users\Admin\AppData\Local\Temp\c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe
"C:\Users\Admin\AppData\Local\Temp\c4949fc1182e7e46bd36686fbfe0bd123b9424591e3b67c046120dd154413d86.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9785574.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9785574.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3651715.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3651715.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6478574.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6478574.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2230368.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2230368.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9785574.exe

Filesize
749KB

MD5
fd4bae594c062b1ca71b0a459366d46a

SHA1
cb4f86fcc9075029b9b6967d10e730ab611144ca

SHA256
9df14b0531dc4a115f5ce1960304bb39ad02416361ebd69a2432c48368acb57d

SHA512
153cfa53ce3e13c5ccc8532fa689640d511932e7eceb00daf81c97d14111c40031b2e082b64de3ef43fe5a14aa74f3a41f947df4c01d9760829413558984414b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3651715.exe

Filesize
305KB

MD5
2d36b234bc84b066a350ca99be2ac3b8

SHA1
1dd1aae43b4440cc59834e734c4b3a8424fa6822

SHA256
773944ab14c3ca17b748f92eac95cbc0492f8807397106a926c05424862b394a

SHA512
6fbeee699e4fd0b558dc7734c3c865b630d04cc135b63a4ab330a466f49589586021966df77e82ad7efd5f103f3b1ad75df603ecee979b15b156148443d71f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6478574.exe

Filesize
183KB

MD5
d18dd7e957d8eab39abe21eefd498331

SHA1
2d7b11252dbb1ed8cefff8d63d447b0f697a0060

SHA256
57f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440

SHA512
c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2230368.exe

Filesize
145KB

MD5
d3f1cd2cb72fe2f0f8528c1da7cfdc12

SHA1
15a4f027ddfc7cf43c25d3cd8249c1d89eba71c8

SHA256
781a3432576e5ba96deb1e2ed078648e3fa5e11afc40bef8fa3952663c42811d

SHA512
b28721b8240c3ed789c67c2b6f474bbc57aa1abbe49562bbd151cc8a69dd139b2a751b57fe8a4cabc4f301a07c9d798d15d62931a9822a24acc2f4ce9dd2349c

Download Submit
memory/3572-49-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-33-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-51-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-22-0x0000000004A30000-0x0000000004FD4000-memory.dmp

Filesize
5.6MB

Download
memory/3572-47-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-46-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-43-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-41-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-39-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-37-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-35-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-23-0x0000000002600000-0x000000000261C000-memory.dmp

Filesize
112KB

Download
memory/3572-31-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-29-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-27-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-25-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-24-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/3572-21-0x0000000002450000-0x000000000246E000-memory.dmp

Filesize
120KB

Download
memory/4468-56-0x0000000000ED0000-0x0000000000EFA000-memory.dmp

Filesize
168KB

Download
memory/4468-57-0x0000000005D40000-0x0000000006358000-memory.dmp

Filesize
6.1MB

Download
memory/4468-58-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/4468-59-0x0000000005790000-0x00000000057A2000-memory.dmp

Filesize
72KB

Download
memory/4468-60-0x00000000057F0000-0x000000000582C000-memory.dmp

Filesize
240KB

Download
memory/4468-61-0x0000000005970000-0x00000000059BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads