redline | 5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd

General

Target

5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe
Size

1.1MB
MD5

a040bf14176dc452a805da0902451cc6
SHA1

46049791dd007e7788e05e4fde5e2b8e513be68b
SHA256

5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd
SHA512

44958fdfefde09ddcb2291a7b08312103838792839f3a8a1c9a46b7e33cfb2f2efa7ec84786296175b04be242f4fb9d2d63645f4131c42d6423a76bae3f93de6
SSDEEP

24576:qydyUf7yyrclBh3VcEFkgFJwvO4AE/q3VebnqYd5RtZY:xdyUT5rclBhlcEFkZvO8ScbnqYP

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k4862271.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4862271.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9303627.exe	family_redline
behavioral1/memory/4868-56-0x0000000000CA0000-0x0000000000CCA000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 4 IoCs

Processes:

y5089563.exey8567487.exek4862271.exel9303627.exe

pid process

4860 y5089563.exe
3792 y8567487.exe
4712 k4862271.exe
4868 l9303627.exe

pid	process
4860	y5089563.exe
3792	y8567487.exe
4712	k4862271.exe
4868	l9303627.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k4862271.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k4862271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4862271.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exey5089563.exey8567487.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5089563.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y8567487.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

y5089563.exey8567487.exek4862271.exel9303627.exe5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5089563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8567487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k4862271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l9303627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k4862271.exe

pid process

4712 k4862271.exe
4712 k4862271.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k4862271.exe

description pid process

Token: SeDebugPrivilege 4712 k4862271.exe

pid	process
4712	k4862271.exe
4712	k4862271.exe

description	pid	process
Token: SeDebugPrivilege	4712	k4862271.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exey5089563.exey8567487.exe

description	pid	process	target process
PID 4052 wrote to memory of 4860	4052	5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe	y5089563.exe
PID 4052 wrote to memory of 4860	4052	5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe	y5089563.exe
PID 4052 wrote to memory of 4860	4052	5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe	y5089563.exe
PID 4860 wrote to memory of 3792	4860	y5089563.exe	y8567487.exe
PID 4860 wrote to memory of 3792	4860	y5089563.exe	y8567487.exe
PID 4860 wrote to memory of 3792	4860	y5089563.exe	y8567487.exe
PID 3792 wrote to memory of 4712	3792	y8567487.exe	k4862271.exe
PID 3792 wrote to memory of 4712	3792	y8567487.exe	k4862271.exe
PID 3792 wrote to memory of 4712	3792	y8567487.exe	k4862271.exe
PID 3792 wrote to memory of 4868	3792	y8567487.exe	l9303627.exe
PID 3792 wrote to memory of 4868	3792	y8567487.exe	l9303627.exe
PID 3792 wrote to memory of 4868	3792	y8567487.exe	l9303627.exe

C:\Users\Admin\AppData\Local\Temp\5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe
"C:\Users\Admin\AppData\Local\Temp\5af2f99e99a9fb24a4d82bb84436765323df6118019db49b8fac4c3008d1c2dd.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5089563.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5089563.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8567487.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8567487.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4862271.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4862271.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9303627.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9303627.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5089563.exe

Filesize
748KB

MD5
1ae193c1770dacc239af2448f8a0d1e0

SHA1
3cdae8250117cee3a68c5b399d1890477826398f

SHA256
1f9f1f298c1b704b0fdd6207ac020c3c1810b9de0e36a9b7df89a847009bf856

SHA512
d814872c35eddc5b351058dc07c214b7c4d34ac25a0202ccb34d604131cd2515f2455c8df84aa65bff80fbf0da6e7be4fe094fccc7c6e324d97f060e749acfe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8567487.exe

Filesize
304KB

MD5
58695353b50b0d79539a8dc5888626ef

SHA1
c9d5a74b74d3b5eb022d8200a83a5eaf5b30f797

SHA256
6d45109cc0ae6088e778818612e07012eb0673586cdc8e5910e2abc33eb888e1

SHA512
6b2020835b22a4b0e3e01568d8559c0dffc32e6420ed948a5ba424e63286c06e39f0cd2a32255851a4cdd4fb1b59c88c7f751c3c7256caff476a1b4c11af3f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4862271.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9303627.exe

Filesize
145KB

MD5
e1af205a55179dbe468f21bdaeea98ff

SHA1
a7ba2a0be23604210f3d0634dda4ab920d989f97

SHA256
24bd0843751232408e7f20ea2c4f922230a385b854678fc2984397d1155ce6f5

SHA512
a64bd41605dd9a17e6c6dac66f358a74b5004daf23eecb47a48706449fcccca24bddf621c452ba54e87ce22eb61f13feea2298a89af6c39c9a5ca3e86e05a413

Download Submit
memory/4712-51-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-35-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-24-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-22-0x0000000004A70000-0x0000000005014000-memory.dmp

Filesize
5.6MB

Download
memory/4712-49-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-47-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-45-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-43-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-41-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-39-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-37-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-23-0x0000000002460000-0x000000000247C000-memory.dmp

Filesize
112KB

Download
memory/4712-33-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-31-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-29-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-27-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-25-0x0000000002460000-0x0000000002476000-memory.dmp

Filesize
88KB

Download
memory/4712-21-0x00000000023F0000-0x000000000240E000-memory.dmp

Filesize
120KB

Download
memory/4868-56-0x0000000000CA0000-0x0000000000CCA000-memory.dmp

Filesize
168KB

Download
memory/4868-57-0x0000000005AF0000-0x0000000006108000-memory.dmp

Filesize
6.1MB

Download
memory/4868-58-0x0000000005630000-0x000000000573A000-memory.dmp

Filesize
1.0MB

Download
memory/4868-59-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/4868-60-0x00000000055C0000-0x00000000055FC000-memory.dmp

Filesize
240KB

Download
memory/4868-61-0x0000000005740000-0x000000000578C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads