redline | 36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe
Size

307KB
MD5

cd8ea3b63e20a3f928c87c1b8d03fbdf
SHA1

3c2a074d94cfa7bd8506eac6662496c5c825c86a
SHA256

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0
SHA512

4aad5f7b258602ec851f5a9cb1177187ed4c3a9cb661a067aef17ebc442f768478f9b83ea1da709817bcca2857afdd52a8ab6b49fe56262a7318b920b007931d
SSDEEP

6144:K5y+bnr+8p0yN90QEIoHmzPipcmKTbP5NuW5IEj0F1PTnV:XMrMy909HePHRT9NRIDx

Score

10^/10

redline dimas evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dimas

185.161.248.75:4132

Attributes

auth_value
a5db9b1c53c704e612bccc93ccdb5539

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k2471059.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2471059.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l7498779.exe family_redline
behavioral17/memory/4840-47-0x0000000000890000-0x00000000008BA000-memory.dmp family_redline
Executes dropped EXE 2 IoCs

Processes:

k2471059.exel7498779.exe

pid process

3952 k2471059.exe
4840 l7498779.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l7498779.exe	family_redline
behavioral17/memory/4840-47-0x0000000000890000-0x00000000008BA000-memory.dmp	family_redline

pid	process
3952	k2471059.exe
4840	l7498779.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k2471059.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2471059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2471059.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k2471059.exe

pid process

3952 k2471059.exe
3952 k2471059.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k2471059.exe

description pid process

Token: SeDebugPrivilege 3952 k2471059.exe

pid	process
3952	k2471059.exe
3952	k2471059.exe

description	pid	process
Token: SeDebugPrivilege	3952	k2471059.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe

description	pid	process	target process
PID 3724 wrote to memory of 3952	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	k2471059.exe
PID 3724 wrote to memory of 3952	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	k2471059.exe
PID 3724 wrote to memory of 3952	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	k2471059.exe
PID 3724 wrote to memory of 4840	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	l7498779.exe
PID 3724 wrote to memory of 4840	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	l7498779.exe
PID 3724 wrote to memory of 4840	3724	65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe	l7498779.exe

C:\Users\Admin\AppData\Local\Temp\65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe
"C:\Users\Admin\AppData\Local\Temp\65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3724

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2471059.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2471059.exe
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l7498779.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l7498779.exe
2⤵
- Executes dropped EXE
PID:4840

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2471059.exe
Filesize
185KB

MD5
3e630811e041742e84b8ea3e59c277d1

SHA1
8a9c6d88e0d8ce0bd9e03658fa832d238a5eccd1

SHA256
960b92763e28e9b1ff62f7b8774351557c3abbf50adf9255ab5767b2851dd20b

SHA512
8d8c4d270f3c4ed32a0dbd0d07e5bd67c8cee508870a8b0a814b17e3c6255e9439054b62cde1d9b293ac50ab37fc10c63cdeccb33f65e6197fd5e7327432685e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l7498779.exe
Filesize
145KB

MD5
52e47d983155cf62607dc0812e77a49a

SHA1
9124386bb578fa4a661310abd756b7e15bccd79f

SHA256
aaaf4310272cf3b8759601adf27310af7afd60417e6e2fe7d4e9cdc182621ff4

SHA512
6699cdae56b212dcfe5d8ad4e32529304e3a31c3233c70ecd116001eb3c9c97eb7b6372425ce1040d8b3034f551f104e8f0859955a84ee63ea3b7c574b437339

Download Submit
memory/3952-39-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-7-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/3952-25-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-11-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-12-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/3952-13-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-8-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/3952-37-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-36-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-33-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-32-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-41-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-30-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-27-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-10-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/3952-23-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-9-0x0000000004BA0000-0x0000000005144000-memory.dmp

Filesize
5.6MB

Download
memory/3952-19-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-17-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-16-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-14-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/3952-43-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-21-0x0000000004AD0000-0x0000000004AE7000-memory.dmp

Filesize
92KB

Download
memory/4840-48-0x00000000748E0000-0x000000007498B000-memory.dmp

Filesize
684KB

Download
memory/4840-47-0x0000000000890000-0x00000000008BA000-memory.dmp

Filesize
168KB

Download
memory/4840-49-0x0000000005830000-0x0000000005E48000-memory.dmp

Filesize
6.1MB

Download
memory/4840-50-0x0000000005360000-0x000000000546A000-memory.dmp

Filesize
1.0MB

Download
memory/4840-51-0x0000000005290000-0x00000000052A2000-memory.dmp

Filesize
72KB

Download
memory/4840-52-0x00000000052F0000-0x000000000532C000-memory.dmp

Filesize
240KB

Download
memory/4840-53-0x0000000005470000-0x00000000054BC000-memory.dmp

Filesize
304KB

Download
memory/4840-54-0x00000000748E0000-0x000000007498B000-memory.dmp

Filesize
684KB

Download