redline | a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe
Size 876KB
Sample241111-ggvywsvbnd
SHA256 a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7
MD5 6f11376a8a98bb83d9b9fd422189b39b
SHA1 b40fb4fb08ca15b08c318a88e967d3856e1ba1cf
SHA512 932c41a09e37b601ef1f9334b17dbaa02b46b428826042b94fb4e0959717ea7c55b21e5f2a5b9d563fa8edf5d25a38cf29994d21c6dbf3b74d42a6d20d1cf9ad
SSDEEP 24576:ry1/bSBhU8HqZRCNcKUXFF3J0bDZosiGtUQO:e1juUwqZRC2zXFF3JmCgU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline meros discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

meros

185.161.248.75:4132

Attributes

auth_value
9c33d62d92462133b601b6435f3c7a0a

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7023013.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7023013.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7023013.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a7023013.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7023013.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7023013.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c86-55.dat	family_redline
behavioral1/memory/2472-57-0x0000000000F30000-0x0000000000F5A000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
3728	v6542173.exe
4144	v6501813.exe
1804	a7023013.exe
2472	b5471055.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a7023013.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7023013.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6542173.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6501813.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6542173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6501813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7023013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5471055.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	a7023013.exe
1804	a7023013.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	a7023013.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3728	2284	a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe	84
PID 2284 wrote to memory of 3728	2284	a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe	84
PID 2284 wrote to memory of 3728	2284	a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe	84
PID 3728 wrote to memory of 4144	3728	v6542173.exe	85
PID 3728 wrote to memory of 4144	3728	v6542173.exe	85
PID 3728 wrote to memory of 4144	3728	v6542173.exe	85
PID 4144 wrote to memory of 1804	4144	v6501813.exe	87
PID 4144 wrote to memory of 1804	4144	v6501813.exe	87
PID 4144 wrote to memory of 1804	4144	v6501813.exe	87
PID 4144 wrote to memory of 2472	4144	v6501813.exe	103
PID 4144 wrote to memory of 2472	4144	v6501813.exe	103
PID 4144 wrote to memory of 2472	4144	v6501813.exe	103

C:\Users\Admin\AppData\Local\Temp\a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe
"C:\Users\Admin\AppData\Local\Temp\a1f39a90d50b57d8242eb4670773a661d0c0de43ecd92f3901f006721a840fe7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6542173.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6542173.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6501813.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6501813.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7023013.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7023013.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5471055.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5471055.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v6542173.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6542173.exe
Size 478KB
SHA256 9b625cf6985fc92bd2fab7e81be37dcc1b371f22df75aad89de06cb37ba08098
MD5 1593a05afdb98a971236eb5320919b5a
SHA1 7868f2331d04407b60d154e3f7642675db8895cd
SHA512 8219f02e3a649146ce51d9f16d9e54aba373dad430bf9cac333d4d1cb110694383651e6df46059fe4c3708f6b09c0b4d3c53431b42974919272900b4d28f4614
SSDEEP 12288:6Mr3y90CBhAvzHfPORsKNOdskl6KAVMFF3V0bTLfZ:pypBhuzHfGR/NDKQMFF3V0b5
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6501813.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6501813.exe
Size 306KB
SHA256 bb138ad511bc26ac788f585e4d38793fc4812c15cf653f858d07b0336869b36d
MD5 de82418a8caeb0579703451e4d5de330
SHA1 7e02e2ab976b77ec54d00facc6e98953aee2a0b2
SHA512 fe215f720a7ffb3b0fa01d1664d7846566e9c41352943733cd4134a0bc40b8b07afd83c3143b3c49d8d5b6c82ffad453731374ee154f955267b809b0f65aa704
SSDEEP 6144:K2y+bnr+cp0yN90QE7oHmzPipcmKTbPRNuldskl6K8VG:CMrYy90yHePHRTdNMdskl6K8VG
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7023013.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7023013.exe
Size 185KB
SHA256 960b92763e28e9b1ff62f7b8774351557c3abbf50adf9255ab5767b2851dd20b
MD5 3e630811e041742e84b8ea3e59c277d1
SHA1 8a9c6d88e0d8ce0bd9e03658fa832d238a5eccd1
SHA512 8d8c4d270f3c4ed32a0dbd0d07e5bd67c8cee508870a8b0a814b17e3c6255e9439054b62cde1d9b293ac50ab37fc10c63cdeccb33f65e6197fd5e7327432685e
SSDEEP 3072:SDKW1LgppLRHMY0TBfJvjcTp5X1ar4D4K78w7SDuJLEjXwX36wCD:SDKW1Lgbdl0TBBvjc/fIw7S0LETw6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

b5471055.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5471055.exe
Size 145KB
SHA256 43e8848bb87422af3000082febc90616eea05dd8c1f4cc6fffa651ad9c317d66
MD5 f0153fbf901c087537c5d4bc59f341d9
SHA1 c0762fe707e5e4c9161303191bb909bab1d1856d
SHA512 0c24af7b2abdfdd1334281946e1f0d257bbc7ca757a484a87c34292c5482a73c29797e0889c6eee1c5dacaf36f86f9a9d17732d79bedc55a72cf8b2f1f4c768b
SSDEEP 3072:JV+m5c9QmRSRl5knLcor5d7NRhhZB8e8hI:JjAf553Rhhr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1804-40-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-34-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-24-0x00000000050B0000-0x0000000005142000-memory.dmp

Download

memory/1804-25-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-32-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-50-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-48-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-47-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-44-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-42-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-22-0x00000000049C0000-0x0000000004F64000-memory.dmp

Download

memory/1804-39-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-36-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-23-0x0000000004F70000-0x0000000004F8C000-memory.dmp

Download

memory/1804-52-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-30-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-28-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-26-0x0000000004F70000-0x0000000004F87000-memory.dmp

Download

memory/1804-21-0x00000000022C0000-0x00000000022DE000-memory.dmp

Download

memory/2472-57-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Download

memory/2472-58-0x0000000005DC0000-0x00000000063D8000-memory.dmp

Download

memory/2472-59-0x00000000058C0000-0x00000000059CA000-memory.dmp

Download

memory/2472-60-0x00000000057F0000-0x0000000005802000-memory.dmp

Download

memory/2472-61-0x0000000005850000-0x000000000588C000-memory.dmp

Download

memory/2472-62-0x00000000059D0000-0x0000000005A1C000-memory.dmp

Download