redline | e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c

General

Target

e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe
Size

1.1MB
MD5

29ed9946f72410bc949585ed2f8c2678
SHA1

4b556a6bbe528faf80bdc4e609f2074e137783ba
SHA256

e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c
SHA512

13c9a48dddf4740b54a37442a1d710f26c3de53f52fa7616c745215a32a0eed4675d3af0b3c01d63f909b307d18eaebf81f5928a2826f00349e1ad9797a48623
SSDEEP

24576:PynRyo+QfigwFkmLgA0VrADLwhXPmydDO3jZh5aj9Tgt:anz+QfigwFkQg3L+WDOT352g

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2862318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2862318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2862318.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2862318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2862318.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2862318.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c7b-54.dat	family_redline
behavioral1/memory/3852-56-0x0000000000270000-0x000000000029A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4108	y9624234.exe
4024	y5679994.exe
5112	k2862318.exe
3852	l4064861.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2862318.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2862318.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9624234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5679994.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5679994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k2862318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l4064861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9624234.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	k2862318.exe
5112	k2862318.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	k2862318.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4108	4480	e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe	83
PID 4480 wrote to memory of 4108	4480	e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe	83
PID 4480 wrote to memory of 4108	4480	e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe	83
PID 4108 wrote to memory of 4024	4108	y9624234.exe	85
PID 4108 wrote to memory of 4024	4108	y9624234.exe	85
PID 4108 wrote to memory of 4024	4108	y9624234.exe	85
PID 4024 wrote to memory of 5112	4024	y5679994.exe	86
PID 4024 wrote to memory of 5112	4024	y5679994.exe	86
PID 4024 wrote to memory of 5112	4024	y5679994.exe	86
PID 4024 wrote to memory of 3852	4024	y5679994.exe	97
PID 4024 wrote to memory of 3852	4024	y5679994.exe	97
PID 4024 wrote to memory of 3852	4024	y5679994.exe	97

C:\Users\Admin\AppData\Local\Temp\e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe
"C:\Users\Admin\AppData\Local\Temp\e0685a10bb69c5952b9c63181353a23771cfbfd3f6823111a9ee2259ed65806c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9624234.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9624234.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5679994.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5679994.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2862318.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2862318.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4064861.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4064861.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9624234.exe

Filesize
749KB

MD5
e2b23b2ba129fbcdca5b6b567af44fdb

SHA1
eca3f8749d5b81a88ea2f61ac398bfd81352aac4

SHA256
a25e99e6ee51e3eef172a0723cb77c4b1561206713c2b53fa1e559501117fee3

SHA512
d5604ce4cb4d42a5c73dfce9eb7071e1047e47059db4710c9a8cc643b2fb036bbfec82fe2ac677cf387664ba68d1bd9f5e183e072d05e7ab54430adf77bb2be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5679994.exe

Filesize
304KB

MD5
47400386a30fcd9f933e8fd0a5606e75

SHA1
7a770e4c39a74d12e98b0b16ae9ea3dbd244da76

SHA256
b920ad82ca7fe5086217cc5731bd7766958114434736ed056cb80a627a0f27de

SHA512
de10f88ef77ad85a20bdb59a0a40e7eb970cd630f3234dc60d6425890fb24b1329b8ecbc12cfb6b1423adfc75b476ab2c4daab73d338ba10c029cabd49c3435a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2862318.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4064861.exe

Filesize
145KB

MD5
71fdfa1d59810bb9b854cd00c6ff8a9c

SHA1
1fa6ff602570938555009fe16a086b679170b284

SHA256
3dc52adb48e51543ac252bf8b405d115fad35525e033d226f15605efe3842606

SHA512
4c9403d51c25facb770f8cfa5a92bc29668e508aec9c089523277dae724afd3a2be717fea4b450acf1544248b2442fcdb1498fe1d898cc2b8f08eeb16b9096ae

Download Submit
memory/3852-61-0x0000000004D10000-0x0000000004D5C000-memory.dmp

Filesize
304KB

Download
memory/3852-60-0x0000000004BA0000-0x0000000004BDC000-memory.dmp

Filesize
240KB

Download
memory/3852-59-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/3852-58-0x0000000004C00000-0x0000000004D0A000-memory.dmp

Filesize
1.0MB

Download
memory/3852-57-0x0000000005080000-0x0000000005698000-memory.dmp

Filesize
6.1MB

Download
memory/3852-56-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/5112-51-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-24-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-39-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-37-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-35-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-33-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-31-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-29-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-28-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-41-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-25-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-43-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-45-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-47-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-49-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/5112-23-0x00000000024F0000-0x000000000250C000-memory.dmp

Filesize
112KB

Download
memory/5112-22-0x0000000004B80000-0x0000000005124000-memory.dmp

Filesize
5.6MB

Download
memory/5112-21-0x0000000002260000-0x000000000227E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads