redline | e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe
Size

551KB
MD5

d857156372904be8c5f12b33e5abb5ad
SHA1

44b71bd920a69a5f542768e854183cd84eadcd55
SHA256

e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7
SHA512

b2a526dbd2657f4083c20d3ec1cb7638bc63e9e922d8956f7b59620a927ac131c68f01e3aff926e33314dc286aae62efabf18e89afc27f875ec96970037488cb
SSDEEP

12288:EMrEy90QJXVHpqVRGGyrOQEPDodHGk5Gh44NhS1W:gyRX1EVwOQvou4rS1W

Score

10^/10

redline fusa infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

fusa

193.233.20.12:4132

Attributes

auth_value
a08b2f01bd2af756e38c5dd60e87e697

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
4976	nar28.exe
4916	bmN44.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	nar28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nar28.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4976	4492	e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe	83
PID 4492 wrote to memory of 4976	4492	e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe	83
PID 4492 wrote to memory of 4976	4492	e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe	83
PID 4976 wrote to memory of 4916	4976	nar28.exe	84
PID 4976 wrote to memory of 4916	4976	nar28.exe	84
PID 4976 wrote to memory of 4916	4976	nar28.exe	84

C:\Users\Admin\AppData\Local\Temp\e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe
"C:\Users\Admin\AppData\Local\Temp\e06bd40eeccb594535de11f72bb5fb4ff12a790978c4a639c836cd61025e55f7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nar28.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nar28.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmN44.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmN44.exe
    3⤵
    - Executes dropped EXE
    PID:4916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nar28.exe

Filesize
202KB

MD5
aab1351d743ce07d324fb420f6735282

SHA1
80ceab00ad9e7e78850ec4c86212228334a84a39

SHA256
3f93af58ec249afea1f9ccbe297fede193c6a09b2bcfd3ac13e8c7325f2fcb9c

SHA512
0377061cdc0f42ac7a0a5c3fa1f1f55c7a353a35231ef78fb9c05593802fdd5f2853a0e6b49161d54728c03efc9ee361a629a2a3037000adad799f14bec0b4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nar28.exe

Filesize
202KB

MD5
aab1351d743ce07d324fb420f6735282

SHA1
80ceab00ad9e7e78850ec4c86212228334a84a39

SHA256
3f93af58ec249afea1f9ccbe297fede193c6a09b2bcfd3ac13e8c7325f2fcb9c

SHA512
0377061cdc0f42ac7a0a5c3fa1f1f55c7a353a35231ef78fb9c05593802fdd5f2853a0e6b49161d54728c03efc9ee361a629a2a3037000adad799f14bec0b4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmN44.exe

Filesize
175KB

MD5
da6f3bef8abc85bd09f50783059964e3

SHA1
a0f25f60ec1896c4c920ea397f40e6ce29724322

SHA256
e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

SHA512
4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bmN44.exe

Filesize
175KB

MD5
da6f3bef8abc85bd09f50783059964e3

SHA1
a0f25f60ec1896c4c920ea397f40e6ce29724322

SHA256
e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

SHA512
4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

Download Submit
memory/4916-138-0x0000000000C70000-0x0000000000CA2000-memory.dmp

Filesize
200KB

Download
memory/4916-139-0x0000000005E10000-0x0000000006428000-memory.dmp

Filesize
6.1MB

Download
memory/4916-140-0x0000000005990000-0x0000000005A9A000-memory.dmp

Filesize
1.0MB

Download
memory/4916-141-0x00000000058C0000-0x00000000058D2000-memory.dmp

Filesize
72KB

Download
memory/4916-142-0x0000000005920000-0x000000000595C000-memory.dmp

Filesize
240KB

Download