redline | ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d

General

Target

ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe
Size

1.1MB
MD5

483ab27c253a37f3d6d42da6086254d0
SHA1

b3f0616928364bb2e93e6739cb4609c1abea417f
SHA256

ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d
SHA512

dab741a0fd707567638a55e7c684e184b5be7ead174f406ade791c37286f8fd7d0545831578821a26250aa338ee8e6aa330404a433d0190b8c699e0a23e7003b
SSDEEP

24576:CysCgJE8l7vcFkghpBWl4nOfzVxy6yioseibOs:pHZI7vcFkgoeEVID3CO

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9318814.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9318814.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9318814.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9318814.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9318814.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k9318814.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023acd-54.dat	family_redline
behavioral1/memory/1824-56-0x0000000000640000-0x000000000066A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4364	y0625225.exe
4092	y5035900.exe
1500	k9318814.exe
1824	l3351890.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9318814.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k9318814.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0625225.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5035900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0625225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5035900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k9318814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3351890.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	k9318814.exe
1500	k9318814.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	k9318814.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4364	4464	ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe	84
PID 4464 wrote to memory of 4364	4464	ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe	84
PID 4464 wrote to memory of 4364	4464	ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe	84
PID 4364 wrote to memory of 4092	4364	y0625225.exe	86
PID 4364 wrote to memory of 4092	4364	y0625225.exe	86
PID 4364 wrote to memory of 4092	4364	y0625225.exe	86
PID 4092 wrote to memory of 1500	4092	y5035900.exe	88
PID 4092 wrote to memory of 1500	4092	y5035900.exe	88
PID 4092 wrote to memory of 1500	4092	y5035900.exe	88
PID 4092 wrote to memory of 1824	4092	y5035900.exe	96
PID 4092 wrote to memory of 1824	4092	y5035900.exe	96
PID 4092 wrote to memory of 1824	4092	y5035900.exe	96

C:\Users\Admin\AppData\Local\Temp\ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe
"C:\Users\Admin\AppData\Local\Temp\ade0009d3fb11b630bc424c19992aeab60cb24c950101cb940d86048348b676d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0625225.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0625225.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5035900.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5035900.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9318814.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9318814.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3351890.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3351890.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0625225.exe

Filesize
750KB

MD5
899a86a9304f292cf7ef93200ccc4d5b

SHA1
8ef4b10a46be17f85a5282d50c9b97b9b003cedd

SHA256
ff581dd250ff4769fe2d741424fabe855b98758bf851738c85a0d30899a6bd3f

SHA512
fa8173014072ab883050e6c30a14e6e4e1dcc02a1d66c37ec65bc68678a40e767e964ec8809a1c6eedc0f183078e02966546f64abb2bef30394e8ba433e978d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5035900.exe

Filesize
304KB

MD5
def0c0feca2029ac32fc8fbee1533f8c

SHA1
eedde4c5f72a9f3f1840cb82aeaeab9bd9ce944c

SHA256
1e238865c7e46971c50309edb7e228c9e9e1e747862218067fffa86dad89b0fa

SHA512
89f25ff866d54b067fe82e6524264628f41926f7cd626a3a0ecfec1628dd59ab84edb364a8897b2a2b5bd76d63eb46fbfa3cc5f1751a7c27162efeaa3e5f57ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9318814.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3351890.exe

Filesize
145KB

MD5
723632ccab55e55f1330abfc6b910ea3

SHA1
e2807976fc295ada9bc243c4f312d991a875e2a7

SHA256
6d286ad0c546c16ad4ee448bcb1ea895fe5d6e5e51de1032f007c5d68b1e2f27

SHA512
1d046e09f05d3cdab188e8ae2c6ab46de7cf433e038ecacf2e4ed4d747a7312dcd03ff87415ffb1bafeaba10df905a9df6d77a6193733ced5ac28d2fb65ee8d1

Download Submit
memory/1500-51-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-29-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-22-0x0000000004B00000-0x00000000050A4000-memory.dmp

Filesize
5.6MB

Download
memory/1500-49-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-47-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-45-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-43-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-41-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-23-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/1500-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-24-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/1500-21-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/1824-56-0x0000000000640000-0x000000000066A000-memory.dmp

Filesize
168KB

Download
memory/1824-57-0x0000000005510000-0x0000000005B28000-memory.dmp

Filesize
6.1MB

Download
memory/1824-58-0x0000000005000000-0x000000000510A000-memory.dmp

Filesize
1.0MB

Download
memory/1824-59-0x0000000004F10000-0x0000000004F22000-memory.dmp

Filesize
72KB

Download
memory/1824-60-0x0000000004F70000-0x0000000004FAC000-memory.dmp

Filesize
240KB

Download
memory/1824-61-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads