redline | 051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376

General

Target

051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe
Size

1.1MB
MD5

b9ae175caf219a1be5a765dbc4434bdb
SHA1

d890cefc7a6f80a22cd5d07ebf531adea6b1562b
SHA256

051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376
SHA512

aa3b20c4722d2b44d8c8e339ce949b6027943374fc34b737b39422b9ed60945c1db5e2a0422b15b650c531ef0585705451afff16592201ed9a3cf7f7f197d0dd
SSDEEP

24576:FyRjDrGR01EOpgerFktPLqrQxMFaezQuF588LOhSvxn4XtKHjws8E:g9D+0++gerFk1LeQxMFaU58OOhSvJfHG

Score

10^/10

redline doma discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes

auth_value
8be53af7f78567706928d0abef953ef4

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k9063033.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9063033.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k9063033.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9063033.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9063033.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9063033.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9063033.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7900108.exe	family_redline
behavioral1/memory/1524-56-0x00000000000B0000-0x00000000000DA000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 4 IoCs

Processes:

y5779820.exey2539392.exek9063033.exel7900108.exe

pid process

556 y5779820.exe
4004 y2539392.exe
844 k9063033.exe
1524 l7900108.exe

pid	process
556	y5779820.exe
4004	y2539392.exe
844	k9063033.exe
1524	l7900108.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k9063033.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k9063033.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9063033.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exey5779820.exey2539392.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5779820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y2539392.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

y2539392.exek9063033.exel7900108.exe051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exey5779820.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2539392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k9063033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7900108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5779820.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k9063033.exe

pid process

844 k9063033.exe
844 k9063033.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k9063033.exe

description pid process

Token: SeDebugPrivilege 844 k9063033.exe

pid	process
844	k9063033.exe
844	k9063033.exe

description	pid	process
Token: SeDebugPrivilege	844	k9063033.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exey5779820.exey2539392.exe

description	pid	process	target process
PID 3688 wrote to memory of 556	3688	051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe	y5779820.exe
PID 3688 wrote to memory of 556	3688	051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe	y5779820.exe
PID 3688 wrote to memory of 556	3688	051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe	y5779820.exe
PID 556 wrote to memory of 4004	556	y5779820.exe	y2539392.exe
PID 556 wrote to memory of 4004	556	y5779820.exe	y2539392.exe
PID 556 wrote to memory of 4004	556	y5779820.exe	y2539392.exe
PID 4004 wrote to memory of 844	4004	y2539392.exe	k9063033.exe
PID 4004 wrote to memory of 844	4004	y2539392.exe	k9063033.exe
PID 4004 wrote to memory of 844	4004	y2539392.exe	k9063033.exe
PID 4004 wrote to memory of 1524	4004	y2539392.exe	l7900108.exe
PID 4004 wrote to memory of 1524	4004	y2539392.exe	l7900108.exe
PID 4004 wrote to memory of 1524	4004	y2539392.exe	l7900108.exe

C:\Users\Admin\AppData\Local\Temp\051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe
"C:\Users\Admin\AppData\Local\Temp\051f634a07cac98ccc761742acb5f0c51ba5407ba359b189890a219cc1213376.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5779820.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5779820.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2539392.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2539392.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9063033.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9063033.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7900108.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7900108.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5779820.exe

Filesize
750KB

MD5
4acca592d5d96cd8137a1cd5958c1dec

SHA1
57bceac13e41e16b85128ec2d4e39b0974dba3a7

SHA256
b7650f15d72a69a3d585dd9cc274231bbc957692486f62e8d4f951efdcd5f1af

SHA512
e44679e007e0b9ce42508188ae4627f8cbbe6eb078c56f95eb93a7d91b5d0c8d4f713dfc24646abc6857d93816273ad8f2aef9b976d347071cd7fa4f5c87af72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2539392.exe

Filesize
304KB

MD5
e2165bd297cfaa11f43392e61aabe50f

SHA1
126a8734b3c2a170402ce9614429a73ae119185a

SHA256
f5b0495487d6e4cc2d729f9a3d343a975562ebc8feb8c21a729f4dcd2a2ac562

SHA512
0bc95b926d803a1abcfc5ff48f43051a4b7b0b79466c49e6af04f971c16ea8ac9c36b77dde6497c52017e390e398286806a137b7794b9b19762b5399be9b1b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9063033.exe

Filesize
183KB

MD5
75df6a4aaf5c63bc4f42ac5ec8ecc76a

SHA1
8d9da11aa11364c1b580b12faa446403f527ff83

SHA256
d1d13ff4eabb541a9cfc225beeb1c27d9cd85c8f9849e8d0fece0a4503c63f05

SHA512
72d34a4770cf9885993630f04e83831f4ded666af58cb705c7b1ca4cd7ca95911dec7247e4987c64afc13fee10bcf94fc913bd9a7790edb65c75b01a89bbe8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7900108.exe

Filesize
145KB

MD5
a3ce3e3aa68b4c7086ad19fbf21b42f5

SHA1
570af48ed191fade810e5bad5296f2da3e1a3042

SHA256
17eed501a914549ce491570785a74fa2b20f38ab127e395eac5f24427780f308

SHA512
9e8aa752c6a2d2d89f78a26a54118100d06dc239d308361bdd7ca20e1fb4c10f43d69bd92c51e91f625d1fdfa3b3e974cb16ce46a1468abc4150c1eca1e5c5f3

Download Submit
memory/844-41-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-33-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-37-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-22-0x0000000004960000-0x0000000004F04000-memory.dmp

Filesize
5.6MB

Download
memory/844-51-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-49-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-47-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-45-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-43-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-39-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-35-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-23-0x0000000004F50000-0x0000000004F6C000-memory.dmp

Filesize
112KB

Download
memory/844-29-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-31-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-27-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-25-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-24-0x0000000004F50000-0x0000000004F66000-memory.dmp

Filesize
88KB

Download
memory/844-21-0x0000000002490000-0x00000000024AE000-memory.dmp

Filesize
120KB

Download
memory/1524-56-0x00000000000B0000-0x00000000000DA000-memory.dmp

Filesize
168KB

Download
memory/1524-57-0x0000000004EE0000-0x00000000054F8000-memory.dmp

Filesize
6.1MB

Download
memory/1524-58-0x0000000004A40000-0x0000000004B4A000-memory.dmp

Filesize
1.0MB

Download
memory/1524-59-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/1524-60-0x00000000049D0000-0x0000000004A0C000-memory.dmp

Filesize
240KB

Download
memory/1524-61-0x0000000004B50000-0x0000000004B9C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads