redline | 191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f

General

Target

191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe
Size

1.1MB
MD5

b6459e30c1cf92b5eccdec46e538cbe5
SHA1

d0f4c7a4eab84f957db8dda4797c1d18f4887369
SHA256

191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f
SHA512

90abf443dd6fb93d60e562b28f939d630a18f21e992db9a69c328212c377af7a64d0d66e5f0935c82ce47d88f010aa271498847f40bb8b69a9aad6296b5e6cc4
SSDEEP

24576:syAlWZPduwMUOrrvTUTZUxtvJorz0vyKPGHtMUimMd3slaTjgd:bA4ZP8UWvTU1UxZJYAvyKEpxMd80fg

Score

10^/10

redline dogma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dogma

C2

185.161.248.75:4132

Attributes

auth_value
d6c5d36e9aa03c956dc76aa0fcbe3639

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5464705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5464705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5464705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5464705.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5464705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5464705.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c79-53.dat	family_redline
behavioral1/memory/2684-56-0x0000000000830000-0x000000000085A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4024	y4646077.exe
4996	y3766403.exe
2500	k5464705.exe
2684	l2612728.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5464705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5464705.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y3766403.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4646077.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k5464705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2612728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y4646077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3766403.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	k5464705.exe
2500	k5464705.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	k5464705.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4024	540	191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe	83
PID 540 wrote to memory of 4024	540	191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe	83
PID 540 wrote to memory of 4024	540	191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe	83
PID 4024 wrote to memory of 4996	4024	y4646077.exe	85
PID 4024 wrote to memory of 4996	4024	y4646077.exe	85
PID 4024 wrote to memory of 4996	4024	y4646077.exe	85
PID 4996 wrote to memory of 2500	4996	y3766403.exe	86
PID 4996 wrote to memory of 2500	4996	y3766403.exe	86
PID 4996 wrote to memory of 2500	4996	y3766403.exe	86
PID 4996 wrote to memory of 2684	4996	y3766403.exe	97
PID 4996 wrote to memory of 2684	4996	y3766403.exe	97
PID 4996 wrote to memory of 2684	4996	y3766403.exe	97

C:\Users\Admin\AppData\Local\Temp\191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe
"C:\Users\Admin\AppData\Local\Temp\191f918020c220afd3cfc0edb47fc42260208a69e1bd125636546c675c38ab7f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4646077.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4646077.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3766403.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3766403.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5464705.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5464705.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2612728.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2612728.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4646077.exe

Filesize
750KB

MD5
61b22d4ed37240c14ef9dc9ce295d963

SHA1
06de23aed65d23b8b12483b6238509060a6ec0f2

SHA256
0b8f755166a35924f101a3c28e7eaa9dc0441acaef3f1929419c7e7a06917c9f

SHA512
e8a28a7957fa0b21547d540e45f789b94c14d790c46dbcf05f58545803be3cd8b7ebf4c2a8b0f49f3dd35f906f4977bcaf4d520429b99bdce44899cadc6b816d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3766403.exe

Filesize
306KB

MD5
b88c0c8a8d1d800fada4fdbc857bf582

SHA1
4b65a9b866cd700f7c236b274583ef95469304bf

SHA256
97458fa24b9003474a543e1cf0544b6c5aac85172ec3458fac816a1884249691

SHA512
67dd4e348c73ef60bf8bcfd7af76b4a18a06b321ab566aeeb3ee4b85aaf07c0eb9df9c80ba5c5605545e8e27c10ef0a9d02ac8b7fe0477489b3299141164caa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5464705.exe

Filesize
185KB

MD5
1a006b4828336aa2814eb2c9662c4c41

SHA1
5ca9ffafe667b8c5938ee18675c0270d179405ed

SHA256
381ca981e3aba2f2bc4b44b7c3e46f7eaf4ee2a28d686d32094729480b9f52a8

SHA512
124491c15d406112befafb3182403c370f25fcafe8c733f84c92eabffca5b6e16f58acc30dbe522e0973be05b13628be583310ca9648e7b2ca0ea5042e6618ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2612728.exe

Filesize
145KB

MD5
caeab852844ff27ef19462f97bf2c8bc

SHA1
0d0e771bdf534d09ccbaee7d1fcf5d8fdf595eab

SHA256
ec393e9974c692b9ffa1112ae345679e8f9848e39b3c3c24c1efe0012595c534

SHA512
3d531065ec14be645ea6a78208974bd8cbf062e725df3d492f796e2c5a13cc2354c91900d49ea38e2612e44ddc83bf4be2f3eedbc0a4f36cf7966b81ed884198

Download Submit
memory/2500-51-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-33-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-49-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-22-0x00000000049C0000-0x0000000004F64000-memory.dmp

Filesize
5.6MB

Download
memory/2500-47-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-45-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-44-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-41-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-39-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-37-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-35-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-23-0x0000000002550000-0x000000000256C000-memory.dmp

Filesize
112KB

Download
memory/2500-31-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-29-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-27-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-25-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-24-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2500-21-0x00000000023C0000-0x00000000023DE000-memory.dmp

Filesize
120KB

Download
memory/2684-56-0x0000000000830000-0x000000000085A000-memory.dmp

Filesize
168KB

Download
memory/2684-57-0x0000000005780000-0x0000000005D98000-memory.dmp

Filesize
6.1MB

Download
memory/2684-58-0x0000000005300000-0x000000000540A000-memory.dmp

Filesize
1.0MB

Download
memory/2684-59-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/2684-60-0x00000000052B0000-0x00000000052EC000-memory.dmp

Filesize
240KB

Download
memory/2684-61-0x0000000005250000-0x000000000529C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads