redline | ee3b8f4cf50bc29ca435db6bfa3b5f4bca15cc3c9e0141819a6fd4e10ee04f5a

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d7fa58e7e42b34000a543097964dfe3.exe
Size 474KB
Sample230214-w92dpseg4x
SHA256 ee3b8f4cf50bc29ca435db6bfa3b5f4bca15cc3c9e0141819a6fd4e10ee04f5a
MD5 6d7fa58e7e42b34000a543097964dfe3
SHA1 6a399fc242b2040e1cbf515e5366bdb2457c30db
SHA512 6e2817301158692ad4755cc44a300133eb755976ac291d1c4c5d0232a21b9921abac8ce12941229644c2c65f3e757730b4a9432ff320c06b11118df87003abc1
SSDEEP 6144:Kmy+bnr+Ep0yN90QE5hOwjMwg9CK+9tOxotZEt+DVTW2HFiCf+rkKGdaUI1rGsI:eMrsy901OwjM79uNPEtPMU4IdTdGt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline fusa infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

fusa

193.233.20.12:4132

Attributes

auth_value
a08b2f01bd2af756e38c5dd60e87e697

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
824	nBP28.exe
972	bFp39.exe

Loads dropped DLL 4 IoCs

pid	Process
1380	6d7fa58e7e42b34000a543097964dfe3.exe
824	nBP28.exe
824	nBP28.exe
972	bFp39.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6d7fa58e7e42b34000a543097964dfe3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6d7fa58e7e42b34000a543097964dfe3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	nBP28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nBP28.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 1380 wrote to memory of 824	1380	6d7fa58e7e42b34000a543097964dfe3.exe	27
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28
PID 824 wrote to memory of 972	824	nBP28.exe	28

C:\Users\Admin\AppData\Local\Temp\6d7fa58e7e42b34000a543097964dfe3.exe
"C:\Users\Admin\AppData\Local\Temp\6d7fa58e7e42b34000a543097964dfe3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nBP28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
Size 200KB
SHA256 b83d250ea33628b82d60941560db9a75fd65275e37cf802a28547ceb65a1a27e
MD5 7ffaaa6f7b4ed6bf3c8af0dbfef83950
SHA1 ecfbb1fdacbd75569ea193c341af97d46d4c0d85
SHA512 2382798a1bb5f823379cf332844ccc7fcb5f59361ec9755e701b28ac7dd14501abcc916ffd8dcd13e694f3cd98f1738bc0d26335c03a9da0597167c74d7dd7ed
SSDEEP 3072:Kry+bnr+O1s5GWp1icKAArDZz4N9GhbkrNEk6pzacxnKSfSyxMlY7:Kry+bnr+jp0yN90QEjzZxnKSnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

nBP28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
Size 200KB
SHA256 b83d250ea33628b82d60941560db9a75fd65275e37cf802a28547ceb65a1a27e
MD5 7ffaaa6f7b4ed6bf3c8af0dbfef83950
SHA1 ecfbb1fdacbd75569ea193c341af97d46d4c0d85
SHA512 2382798a1bb5f823379cf332844ccc7fcb5f59361ec9755e701b28ac7dd14501abcc916ffd8dcd13e694f3cd98f1738bc0d26335c03a9da0597167c74d7dd7ed
SSDEEP 3072:Kry+bnr+O1s5GWp1icKAArDZz4N9GhbkrNEk6pzacxnKSfSyxMlY7:Kry+bnr+jp0yN90QEjzZxnKSnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFp39.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFp39.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

nBP28.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
Size 200KB
SHA256 b83d250ea33628b82d60941560db9a75fd65275e37cf802a28547ceb65a1a27e
MD5 7ffaaa6f7b4ed6bf3c8af0dbfef83950
SHA1 ecfbb1fdacbd75569ea193c341af97d46d4c0d85
SHA512 2382798a1bb5f823379cf332844ccc7fcb5f59361ec9755e701b28ac7dd14501abcc916ffd8dcd13e694f3cd98f1738bc0d26335c03a9da0597167c74d7dd7ed
SSDEEP 3072:Kry+bnr+O1s5GWp1icKAArDZz4N9GhbkrNEk6pzacxnKSfSyxMlY7:Kry+bnr+jp0yN90QEjzZxnKSnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

nBP28.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\nBP28.exe
Size 200KB
SHA256 b83d250ea33628b82d60941560db9a75fd65275e37cf802a28547ceb65a1a27e
MD5 7ffaaa6f7b4ed6bf3c8af0dbfef83950
SHA1 ecfbb1fdacbd75569ea193c341af97d46d4c0d85
SHA512 2382798a1bb5f823379cf332844ccc7fcb5f59361ec9755e701b28ac7dd14501abcc916ffd8dcd13e694f3cd98f1738bc0d26335c03a9da0597167c74d7dd7ed
SSDEEP 3072:Kry+bnr+O1s5GWp1icKAArDZz4N9GhbkrNEk6pzacxnKSfSyxMlY7:Kry+bnr+jp0yN90QEjzZxnKSnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFp39.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFp39.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\bFp39.exe
Size 175KB
SHA256 e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
MD5 da6f3bef8abc85bd09f50783059964e3
SHA1 a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA512 4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
SSDEEP 3072:DxqZWN9abUP0PhSECUce2WF5hsfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:VqZ5hSElb5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/972-67-0x0000000000250000-0x0000000000282000-memory.dmp

Download

memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads