redline | 00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a

General

Target

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
Size

436KB
MD5

2a2d98e0668bfa09de545fa6531db417
SHA1

a723bcdc464d1f9b948b4cf641a6b3251ba9ebfb
SHA256

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a
SHA512

f3993c04e244a834e04c9233c7e0b1175810e68644fae1413c50de8d541e4e89f7ede770a773605903ff3b3a53c673f035a373599d072baec9c67ef9505dbb1b
SSDEEP

6144:Kmy+bnr+Jp0yN90QEF3qiledXNoIA6c0nmPbrT4jBfGA6X4cLZcQyTH47AxzxC0B:OMrBy903qi41NmZwmHmXAchzE0B

Score

10^/10

redline ronur infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 36 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-68-0x00000000022D0000-0x0000000002316000-memory.dmp	family_redline
behavioral1/memory/1992-69-0x0000000002310000-0x0000000002354000-memory.dmp	family_redline
behavioral1/memory/1992-70-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-77-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-75-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-73-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-71-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-79-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-83-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-86-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-88-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-90-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-92-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-94-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-96-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-98-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-100-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-102-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-104-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-106-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-108-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-110-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-112-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-114-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-116-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-118-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-120-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-122-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-124-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-126-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-128-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-130-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-132-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-134-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-136-0x0000000002310000-0x000000000234E000-memory.dmp	family_redline
behavioral1/memory/1992-979-0x0000000004D70000-0x0000000004DB0000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

ewT93Yd45.exe

pid process

1992 ewT93Yd45.exe

pid	process
1992	ewT93Yd45.exe

Loads dropped DLL 3 IoCs

Processes:

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exeewT93Yd45.exe

pid	process
2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
1992	ewT93Yd45.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ewT93Yd45.exe

description pid process

Token: SeDebugPrivilege 1992 ewT93Yd45.exe

description	pid	process
Token: SeDebugPrivilege	1992	ewT93Yd45.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

description	pid	process	target process
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2044 wrote to memory of 1992	2044	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe

C:\Users\Admin\AppData\Local\Temp\00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
"C:\Users\Admin\AppData\Local\Temp\00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
memory/1992-98-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-104-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-70-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-77-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-75-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-73-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-71-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-80-0x0000000000240000-0x000000000028B000-memory.dmp

Filesize
300KB

Download
memory/1992-79-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-82-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-84-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-83-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-86-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-88-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-90-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-92-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-94-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-96-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-68-0x00000000022D0000-0x0000000002316000-memory.dmp

Filesize
280KB

Download
memory/1992-100-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-102-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-69-0x0000000002310000-0x0000000002354000-memory.dmp

Filesize
272KB

Download
memory/1992-106-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-108-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-110-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-112-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-114-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-116-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-118-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-120-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-122-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-124-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-126-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-128-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-130-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-132-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-134-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-136-0x0000000002310000-0x000000000234E000-memory.dmp

Filesize
248KB

Download
memory/1992-979-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-981-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-982-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-983-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1992-985-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads