redline | 14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0

General

Target

14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe
Size

1.1MB
MD5

93679766a90f415e60b01e5450cd8885
SHA1

87647a3d1259facb6d6e2819aeba4b835c5da813
SHA256

14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0
SHA512

e64b7456a9ff2b89b53a9a1905f96b9c5bbe2a7c6fd325fed1cb4451bbcd51e9aa8886f068db53a6a417aef0b200901e1a13a7daaca596d0daf269e1a80a89d8
SSDEEP

24576:3yTn1sxHPnTmbFk/PmiHF2kwS7jbAd7pFMc2xHg0JAr:CTn1sxHPibFk/Pmw2Mjb0oHk

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8351015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8351015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8351015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8351015.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8351015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8351015.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b6b-54.dat	family_redline
behavioral1/memory/1812-56-0x00000000000E0000-0x000000000010A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
420	y9268411.exe
3616	y1459612.exe
1308	k8351015.exe
1812	l0495563.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8351015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8351015.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9268411.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1459612.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4040	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9268411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1459612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k8351015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l0495563.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1308	k8351015.exe
1308	k8351015.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	k8351015.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 420	3024	14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe	85
PID 3024 wrote to memory of 420	3024	14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe	85
PID 3024 wrote to memory of 420	3024	14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe	85
PID 420 wrote to memory of 3616	420	y9268411.exe	86
PID 420 wrote to memory of 3616	420	y9268411.exe	86
PID 420 wrote to memory of 3616	420	y9268411.exe	86
PID 3616 wrote to memory of 1308	3616	y1459612.exe	87
PID 3616 wrote to memory of 1308	3616	y1459612.exe	87
PID 3616 wrote to memory of 1308	3616	y1459612.exe	87
PID 3616 wrote to memory of 1812	3616	y1459612.exe	94
PID 3616 wrote to memory of 1812	3616	y1459612.exe	94
PID 3616 wrote to memory of 1812	3616	y1459612.exe	94

C:\Users\Admin\AppData\Local\Temp\14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe
"C:\Users\Admin\AppData\Local\Temp\14f4293b18cf8d61d17c27453a0421e672a070bf35c6df5160b9f561d21222b0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9268411.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9268411.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1459612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1459612.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8351015.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8351015.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0495563.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0495563.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1812

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9268411.exe

Filesize
749KB

MD5
cd82172bd95984a5c8c91a15ceb87891

SHA1
42602dd78f17ec5fe7ce554749597559480d76c7

SHA256
1fece660c9408ab186fd5590fdf4abe76fc8eac719b331c3b04091fcd2c9aefd

SHA512
e714a715372b645c7ac25c77cd21948b780eb5cff0997022bbccc3ffa507c7ec20ea0fb5c2f07356f7f23e692b5fa464cee530c6d4c5e43da33759e091a9dc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1459612.exe

Filesize
304KB

MD5
ec082e5b19dcf2c865337d6024df4268

SHA1
0aa271f2576c559240118b403f273f18c8d2c985

SHA256
e9b8ea5b057d17cb71193c8fc577e92f8cadb12b2444639a3cf66c89f67b9dfb

SHA512
cadb5fa82a2e567411f97933af546ca70a9f57e17792cc33237a4b5fc41a2effcee96c634a513cd7b44eaa787d185f660674716ea4bed2a07e1e93ab83835a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8351015.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0495563.exe

Filesize
145KB

MD5
3023b17408567b07653257f034f0f10d

SHA1
9b7e8e33bb2a32349c09caf65172ee7217f22d15

SHA256
09dfbd367615ee2e930afbdfcc94c74648073876a01f3d56e592b0b0feb3b5fc

SHA512
529e831ab0d314bdbf08541860ae964969a77c501995c2cc2c4c555aa9f559225b745bac6a0792e60c60ba7654a9ac62c3999fe9a0c90faccb467a4aa3b84201

Download Submit
memory/1308-51-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-31-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-41-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-22-0x0000000004AA0000-0x0000000005044000-memory.dmp

Filesize
5.6MB

Download
memory/1308-49-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-47-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-45-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-43-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-37-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-35-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-33-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-23-0x0000000005090000-0x00000000050AC000-memory.dmp

Filesize
112KB

Download
memory/1308-29-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-27-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-24-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-39-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-25-0x0000000005090000-0x00000000050A6000-memory.dmp

Filesize
88KB

Download
memory/1308-21-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/1812-56-0x00000000000E0000-0x000000000010A000-memory.dmp

Filesize
168KB

Download
memory/1812-57-0x0000000005020000-0x0000000005638000-memory.dmp

Filesize
6.1MB

Download
memory/1812-58-0x0000000004BA0000-0x0000000004CAA000-memory.dmp

Filesize
1.0MB

Download
memory/1812-59-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/1812-60-0x0000000004B40000-0x0000000004B7C000-memory.dmp

Filesize
240KB

Download
memory/1812-61-0x0000000004CB0000-0x0000000004CFC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads