redline | b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125

General

Target

b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe
Size

1.1MB
MD5

c068e2d9dbc80a175a0ab31ebfa81101
SHA1

59c4c0fd068737067b69a0b301da3911c28f5166
SHA256

b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125
SHA512

29339b3c1e4bf5ec07a9af516491ee111b056d82a88390dc894abd147fb42cac6d0bc4a089029575930e7c88f04cc435ef2242b17031fefb1a2dce6521e88333
SSDEEP

24576:LyYbUVbmVZiTObME2g931W0LqACOik88OG5alW3wOABj:+Y4sZgO4E2g9FhL2Oik88OAalPVB

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k1488280.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1488280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1488280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1488280.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1488280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1488280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1488280.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000a000000023b82-54.dat	family_redline
behavioral1/memory/3552-56-0x0000000000140000-0x000000000016A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

Processes:

y2093136.exey6225154.exek1488280.exel7702806.exe

pid	Process
2392	y2093136.exe
4048	y6225154.exe
3292	k1488280.exe
3552	l7702806.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k1488280.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1488280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1488280.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exey2093136.exey6225154.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2093136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6225154.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
3432	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exey2093136.exey6225154.exek1488280.exel7702806.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2093136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y6225154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1488280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7702806.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k1488280.exe

pid	Process
3292	k1488280.exe
3292	k1488280.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k1488280.exe

description	pid	Process
Token: SeDebugPrivilege	3292	k1488280.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exey2093136.exey6225154.exe

description	pid	Process	procid_target
PID 3420 wrote to memory of 2392	3420	b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe	83
PID 3420 wrote to memory of 2392	3420	b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe	83
PID 3420 wrote to memory of 2392	3420	b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe	83
PID 2392 wrote to memory of 4048	2392	y2093136.exe	84
PID 2392 wrote to memory of 4048	2392	y2093136.exe	84
PID 2392 wrote to memory of 4048	2392	y2093136.exe	84
PID 4048 wrote to memory of 3292	4048	y6225154.exe	86
PID 4048 wrote to memory of 3292	4048	y6225154.exe	86
PID 4048 wrote to memory of 3292	4048	y6225154.exe	86
PID 4048 wrote to memory of 3552	4048	y6225154.exe	96
PID 4048 wrote to memory of 3552	4048	y6225154.exe	96
PID 4048 wrote to memory of 3552	4048	y6225154.exe	96

C:\Users\Admin\AppData\Local\Temp\b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe
"C:\Users\Admin\AppData\Local\Temp\b2cfcb9a1584bf95e000511d20a0231f5ca479ef26c20ba7207445100118d125.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2093136.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2093136.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6225154.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6225154.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1488280.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1488280.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7702806.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7702806.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3552

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2093136.exe

Filesize
749KB

MD5
5442b603a9a369d39aaf421cac50d8b2

SHA1
f682a5cf74ab31b63271c212c828679c0cd8db96

SHA256
dfa75272e3d1f1631bd6f2920fa741908696d9be55da5b7fbb2e11e1d3730f24

SHA512
b81a6a65c4616ee6dbb3205cda5819791d2657691b931fb4c17f3edad42c49ceb6b1901cb9f9b583edf6d91663c815a7f351c2572c6ffc46a1efb6b005b20ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6225154.exe

Filesize
305KB

MD5
fa787aae5dab2fc56d5a8cae81ffb3ce

SHA1
4a29060f8e71b372e33142c7e842736f97b03614

SHA256
8a8d934f1f84ed2bd89a12547746bc6213f2f5376c137f7e89cbcdfbf5b1eff5

SHA512
bd6d757875320f6f007aab7297d6b522c009d85fad104e588b955e13e911f586762a46ab117b8a3103b9c92f90fc78ce17e3931c4e0cd7971cb33a8d2b6ab05d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1488280.exe

Filesize
183KB

MD5
d18dd7e957d8eab39abe21eefd498331

SHA1
2d7b11252dbb1ed8cefff8d63d447b0f697a0060

SHA256
57f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440

SHA512
c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7702806.exe

Filesize
145KB

MD5
62129a9c6900fcd88d6d5b012033eb16

SHA1
2a7c454198c1a3b245c01d1a7bac4e3865e51a55

SHA256
a660a8770daf18ca869e3d0c33d8772bdeb708f80c473568c2cfb016130a66d9

SHA512
0704f0b3933cd86998c831689e7ea37b3c49adfa833a30101f0c1b2708e42ed5bad2e740f9add9742c13bde8f1a4736a867330334e0bde2b8e5585e2bf915ef8

Download Submit
memory/3292-51-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-22-0x0000000004BC0000-0x0000000005164000-memory.dmp

Filesize
5.6MB

Download
memory/3292-49-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-45-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-43-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-42-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-23-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/3292-29-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-24-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-47-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3292-21-0x0000000002400000-0x000000000241E000-memory.dmp

Filesize
120KB

Download
memory/3552-56-0x0000000000140000-0x000000000016A000-memory.dmp

Filesize
168KB

Download
memory/3552-57-0x00000000050B0000-0x00000000056C8000-memory.dmp

Filesize
6.1MB

Download
memory/3552-58-0x0000000004C10000-0x0000000004D1A000-memory.dmp

Filesize
1.0MB

Download
memory/3552-59-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/3552-60-0x0000000004BB0000-0x0000000004BEC000-memory.dmp

Filesize
240KB

Download
memory/3552-61-0x0000000004D20000-0x0000000004D6C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads