redline | 985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6

General

Target

985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe
Size

1.1MB
MD5

a1b02ba681a1ad1a5ec16d9684ff26ae
SHA1

ec2b631c090cd9f75726a87d75cb8147642b48f1
SHA256

985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6
SHA512

53d58cf6d0a0c45fb82bc1b05c579facd0c101b4ce6813e30708975985ea71018f4e37e2bf60cf4affc2bfb4a0222660ee0ec6181ab8cd5c0e6bdfdf233aaa0d
SSDEEP

24576:ryDcxBgwmzVmZH7XxE7g9j4G/gaGC1w6bhGUK0XL/qnJzyY1xrDGDa:eDKBVZH7BE7g9jL0cT9S6qVyYbrDGD

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k1901830.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1901830.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1901830.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1901830.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1901830.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1901830.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1901830.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5328459.exe	family_redline
behavioral1/memory/2312-56-0x0000000000B60000-0x0000000000B8A000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 4 IoCs

Processes:

y2404296.exey9779079.exek1901830.exel5328459.exe

pid process

3708 y2404296.exe
4480 y9779079.exe
992 k1901830.exe
2312 l5328459.exe

pid	process
3708	y2404296.exe
4480	y9779079.exe
992	k1901830.exe
2312	l5328459.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k1901830.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1901830.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1901830.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exey2404296.exey9779079.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2404296.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9779079.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

y2404296.exey9779079.exek1901830.exel5328459.exe985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2404296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9779079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1901830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l5328459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k1901830.exe

pid process

992 k1901830.exe
992 k1901830.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k1901830.exe

description pid process

Token: SeDebugPrivilege 992 k1901830.exe

pid	process
992	k1901830.exe
992	k1901830.exe

description	pid	process
Token: SeDebugPrivilege	992	k1901830.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exey2404296.exey9779079.exe

description	pid	process	target process
PID 4752 wrote to memory of 3708	4752	985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe	y2404296.exe
PID 4752 wrote to memory of 3708	4752	985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe	y2404296.exe
PID 4752 wrote to memory of 3708	4752	985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe	y2404296.exe
PID 3708 wrote to memory of 4480	3708	y2404296.exe	y9779079.exe
PID 3708 wrote to memory of 4480	3708	y2404296.exe	y9779079.exe
PID 3708 wrote to memory of 4480	3708	y2404296.exe	y9779079.exe
PID 4480 wrote to memory of 992	4480	y9779079.exe	k1901830.exe
PID 4480 wrote to memory of 992	4480	y9779079.exe	k1901830.exe
PID 4480 wrote to memory of 992	4480	y9779079.exe	k1901830.exe
PID 4480 wrote to memory of 2312	4480	y9779079.exe	l5328459.exe
PID 4480 wrote to memory of 2312	4480	y9779079.exe	l5328459.exe
PID 4480 wrote to memory of 2312	4480	y9779079.exe	l5328459.exe

C:\Users\Admin\AppData\Local\Temp\985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe
"C:\Users\Admin\AppData\Local\Temp\985cbaba5fbc20bb04e733e0bd4459aae50d495802fdcde79ee5f982748895d6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2404296.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2404296.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9779079.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9779079.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1901830.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1901830.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5328459.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5328459.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2404296.exe

Filesize
749KB

MD5
e68ad715609518806de5f2384421e0ad

SHA1
1c7dd8d2826e61175d8c9dcb6a4255f003d4d2ad

SHA256
87a320501f9987868660dcf06a59eab7b1b4bc81df3a6e67e5b23cd4b5e9564f

SHA512
e4a22defc10b16cbabbb880959e8496035b0fc91b3e485b4c7efc60a074f378c68f0445a46839b8f8d3ecdd6be4269c9087c47dfebf205ca2c900f3dcfb01682

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9779079.exe

Filesize
305KB

MD5
705b573a6c16bb9c8204bcee976a948e

SHA1
01b84d2de53f08e43606d8147ff2505e3356c36f

SHA256
f36f794306c677c20a87d66e95ef8cfe4f9c7531c6f69ac9e8a34d15faa85fe7

SHA512
35ea0e93a3471067ec72894c53112e366d478fa1e0ab38b1bb2884fa9b7d839399c59eadf75d0499e7f58d2a1b74265ab67731400adc7743b0f81316c99ebc8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1901830.exe

Filesize
183KB

MD5
d18dd7e957d8eab39abe21eefd498331

SHA1
2d7b11252dbb1ed8cefff8d63d447b0f697a0060

SHA256
57f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440

SHA512
c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l5328459.exe

Filesize
145KB

MD5
8cd993a30dc60c83c6e2c454fa71c6d1

SHA1
99f9822fed149db54220247093da02212711c878

SHA256
9a316f9cfe9d073480d214345f1f93badaf71b92cd4d49d68eb62990dcba410b

SHA512
14fab7d4ffa23d5141e2c8b36978d837ff788f1e01939091b3fb328d39ef292a0b1b66cbda8fd783294ebafbc373d1798b3da878defccf5272860289640d28e1

Download Submit
memory/992-49-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-33-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-51-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-22-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/992-47-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-45-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-43-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-41-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-39-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-37-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-35-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-23-0x0000000002340000-0x000000000235C000-memory.dmp

Filesize
112KB

Download
memory/992-31-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-29-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-27-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-25-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-24-0x0000000002340000-0x0000000002356000-memory.dmp

Filesize
88KB

Download
memory/992-21-0x00000000021F0000-0x000000000220E000-memory.dmp

Filesize
120KB

Download
memory/2312-56-0x0000000000B60000-0x0000000000B8A000-memory.dmp

Filesize
168KB

Download
memory/2312-57-0x0000000005970000-0x0000000005F88000-memory.dmp

Filesize
6.1MB

Download
memory/2312-58-0x00000000054F0000-0x00000000055FA000-memory.dmp

Filesize
1.0MB

Download
memory/2312-59-0x0000000005420000-0x0000000005432000-memory.dmp

Filesize
72KB

Download
memory/2312-60-0x0000000005480000-0x00000000054BC000-memory.dmp

Filesize
240KB

Download
memory/2312-61-0x0000000005600000-0x000000000564C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads