redline | 565517ddfa6d09fa094c5dbddfe70447d0fcc0f2dfe66bba5f9f9ef73c47c6d6

General

Target

7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Size

427KB
MD5

c34729173ecc820eb7674431597d78be
SHA1

884f343876a8bb0ebac63c28191c22c6f69590f8
SHA256

7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
SHA512

f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0
SSDEEP

3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI

Score

10^/10

redline nigh infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

Nigh

C2

80.66.87.20:80

Attributes

auth_value
dab8506635d1dc134af4ebaedf4404eb

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2924-150-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exeSETUP_~1.EXE

pid process

3052 SETUP_~1.EXE
3144 Hwqujbjwlyvggktrainingadministrator_s.exe
2924 SETUP_~1.EXE

pid	process
3052	SETUP_~1.EXE
3144	Hwqujbjwlyvggktrainingadministrator_s.exe
2924	SETUP_~1.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SETUP_~1.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SETUP_~1.EXE

description pid process target process

PID 3052 set thread context of 2924 3052 SETUP_~1.EXE SETUP_~1.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3284 powershell.exe
3284 powershell.exe

description	pid	process	target process
PID 3052 set thread context of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE

pid	process
3284	powershell.exe
3284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SETUP_~1.EXEpowershell.exeHwqujbjwlyvggktrainingadministrator_s.exe

description	pid	process
Token: SeDebugPrivilege	3052	SETUP_~1.EXE
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	3144	Hwqujbjwlyvggktrainingadministrator_s.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exeSETUP_~1.EXE

description	pid	process	target process
PID 1112 wrote to memory of 3052	1112	7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe	SETUP_~1.EXE
PID 1112 wrote to memory of 3052	1112	7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe	SETUP_~1.EXE
PID 1112 wrote to memory of 3052	1112	7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe	SETUP_~1.EXE
PID 3052 wrote to memory of 3284	3052	SETUP_~1.EXE	powershell.exe
PID 3052 wrote to memory of 3284	3052	SETUP_~1.EXE	powershell.exe
PID 3052 wrote to memory of 3284	3052	SETUP_~1.EXE	powershell.exe
PID 3052 wrote to memory of 3144	3052	SETUP_~1.EXE	Hwqujbjwlyvggktrainingadministrator_s.exe
PID 3052 wrote to memory of 3144	3052	SETUP_~1.EXE	Hwqujbjwlyvggktrainingadministrator_s.exe
PID 3052 wrote to memory of 3144	3052	SETUP_~1.EXE	Hwqujbjwlyvggktrainingadministrator_s.exe
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE
PID 3052 wrote to memory of 2924	3052	SETUP_~1.EXE	SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
"C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe
"C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
3⤵
- Executes dropped EXE
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log
Filesize
1KB

MD5
e87e48b105757e1c7563d1c719059733

SHA1
28a3f2b2e0672da2b531f4757d2b20b53032dafc

SHA256
0aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461

SHA512
bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe
Filesize
6KB

MD5
d0b53e53092311bc055630adf3e4ccdc

SHA1
bf66777607a1d968e3194fe047f9a0e03f249f28

SHA256
0cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e

SHA512
34ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe
Filesize
6KB

MD5
d0b53e53092311bc055630adf3e4ccdc

SHA1
bf66777607a1d968e3194fe047f9a0e03f249f28

SHA256
0cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e

SHA512
34ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
214.6MB

MD5
4786de75433835fdc9d3d08edf8116ca

SHA1
2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

SHA256
d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

SHA512
e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
214.6MB

MD5
4786de75433835fdc9d3d08edf8116ca

SHA1
2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

SHA256
d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

SHA512
e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
214.6MB

MD5
4786de75433835fdc9d3d08edf8116ca

SHA1
2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

SHA256
d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

SHA512
e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

Download Submit
memory/2924-150-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2924-155-0x0000000003120000-0x0000000003132000-memory.dmp

Filesize
72KB

Download
memory/2924-154-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/2924-153-0x0000000005CE0000-0x00000000062F8000-memory.dmp

Filesize
6.1MB

Download
memory/2924-156-0x0000000005700000-0x000000000573C000-memory.dmp

Filesize
240KB

Download
memory/2924-149-0x0000000000000000-mapping.dmp

Download
memory/3052-132-0x0000000000000000-mapping.dmp

Download
memory/3052-136-0x0000000005730000-0x0000000005752000-memory.dmp

Filesize
136KB

Download
memory/3052-135-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/3144-145-0x0000000000000000-mapping.dmp

Download
memory/3144-148-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/3284-138-0x0000000003320000-0x0000000003356000-memory.dmp

Filesize
216KB

Download
memory/3284-144-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

Filesize
104KB

Download
memory/3284-143-0x0000000008150000-0x00000000087CA000-memory.dmp

Filesize
6.5MB

Download
memory/3284-142-0x0000000006900000-0x000000000691E000-memory.dmp

Filesize
120KB

Download
memory/3284-141-0x00000000062F0000-0x0000000006356000-memory.dmp

Filesize
408KB

Download
memory/3284-140-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/3284-139-0x0000000005AE0000-0x0000000006108000-memory.dmp

Filesize
6.2MB

Download
memory/3284-137-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads