redline | 00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a

General

Target

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
Size

436KB
MD5

2a2d98e0668bfa09de545fa6531db417
SHA1

a723bcdc464d1f9b948b4cf641a6b3251ba9ebfb
SHA256

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a
SHA512

f3993c04e244a834e04c9233c7e0b1175810e68644fae1413c50de8d541e4e89f7ede770a773605903ff3b3a53c673f035a373599d072baec9c67ef9505dbb1b
SSDEEP

6144:Kmy+bnr+Jp0yN90QEF3qiledXNoIA6c0nmPbrT4jBfGA6X4cLZcQyTH47AxzxC0B:OMrBy903qi41NmZwmHmXAchzE0B

Score

10^/10

redline ronur infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2612-145-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-146-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-148-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-150-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-152-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-156-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-154-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-158-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-160-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-162-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-166-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-168-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-164-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-170-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-172-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-174-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-176-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-178-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-180-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-182-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-184-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-186-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-188-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-190-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-192-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-194-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-202-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-200-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-204-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-198-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-196-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-206-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline
behavioral2/memory/2612-208-0x0000000002740000-0x000000000277E000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

ewT93Yd45.exe

pid process

2612 ewT93Yd45.exe

pid	process
2612	ewT93Yd45.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ewT93Yd45.exe

description pid process

Token: SeDebugPrivilege 2612 ewT93Yd45.exe

description	pid	process
Token: SeDebugPrivilege	2612	ewT93Yd45.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe

description	pid	process	target process
PID 2756 wrote to memory of 2612	2756	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2756 wrote to memory of 2612	2756	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe
PID 2756 wrote to memory of 2612	2756	00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe	ewT93Yd45.exe

C:\Users\Admin\AppData\Local\Temp\00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe
"C:\Users\Admin\AppData\Local\Temp\00e4ff4570f3f9e5bead25562a9c32c31b75af7c701c9d58e77932f60e20271a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ewT93Yd45.exe
Filesize
314KB

MD5
b684485c529fbf2cb295200373e8d31f

SHA1
2cff55a7b5add657390ce503eed4acee86216ec8

SHA256
549ab201c8338ecd4dd02e389c7193f173102b48f1e334bd027dbee09579a336

SHA512
24ec3be472f93da9413b1f4fea9338deeae8a42933d765e886e75ea3e013e8d5a1bbba1e466c4877ac8cf68b351958a63b007d5a0a1990474d5a15227b4cb634

Download Submit
memory/2612-141-0x00000000006A0000-0x00000000006EB000-memory.dmp

Filesize
300KB

Download
memory/2612-142-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/2612-143-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/2612-144-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/2612-145-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-146-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-148-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-150-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-152-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-156-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-154-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-158-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-160-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-162-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-166-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-168-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-164-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-170-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-172-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-174-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-176-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-178-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-180-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-182-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-184-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-186-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-188-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-190-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-192-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-194-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-202-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-200-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-204-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-198-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-196-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-206-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-208-0x0000000002740000-0x000000000277E000-memory.dmp

Filesize
248KB

Download
memory/2612-1052-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/2612-1053-0x00000000051C0000-0x00000000057D8000-memory.dmp

Filesize
6.1MB

Download
memory/2612-1054-0x0000000005830000-0x000000000593A000-memory.dmp

Filesize
1.0MB

Download
memory/2612-1055-0x0000000005970000-0x0000000005982000-memory.dmp

Filesize
72KB

Download
memory/2612-1056-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/2612-1057-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads