redline | 6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe
Size 479KB
Sample230506-2bc64sea5v
SHA256 6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72
MD5 7e6b4bb05efc9d5d8861b32fc379024f
SHA1 1cff1a92debd690955a2ce9734719b0da3f8caee
SHA512 bfc24ca4fc537561e8f313b4a6e3482cd273d90d7abd2ad0e0da2fb40438dfc233c71ab3a14aea92163ba97a9b1944a32e85d44535200d6254639e8a3534fec6
SSDEEP 12288:CMrSy90s6t0mnh5PrX6ux2Orl9apndCIhT:cy20KhtbAObAHT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline infostealer persistence stealer

Malware Config

Signatures

Detects Redline Stealer samples 1 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/368-148-0x00000000080E0000-0x00000000086F8000-memory.dmp	redline_stealer

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1536	x4027638.exe
368	g9422422.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4027638.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4027638.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1536	3524	6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe	83
PID 3524 wrote to memory of 1536	3524	6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe	83
PID 3524 wrote to memory of 1536	3524	6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe	83
PID 1536 wrote to memory of 368	1536	x4027638.exe	84
PID 1536 wrote to memory of 368	1536	x4027638.exe	84
PID 1536 wrote to memory of 368	1536	x4027638.exe	84

C:\Users\Admin\AppData\Local\Temp\6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe
"C:\Users\Admin\AppData\Local\Temp\6c0f538ea18a55a9ac2033ea47d3c83c5878cf208f2df3de2557faaa8ef2fb72.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4027638.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4027638.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422422.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422422.exe
    3⤵
    - Executes dropped EXE
    PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4027638.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4027638.exe
Size 307KB
SHA256 e5a5569975594b794264c140bf51d0547dded325311edfdad8b74827f81658ad
MD5 06f49896f2a3df2c78411ef8088b6890
SHA1 a4c1dcbb43a86d9950c3abd7775deb6cbac9fb26
SHA512 5c220f14ed468ca9e59e86cda57f71b4c4f7438709b83f9df15986e3dd5393c1a4c1422494d8c25d8d205997606b7ba79ca940025e0df4eb4c658364d0350f93
SSDEEP 6144:Kcy+bnr+Sp0yN90QE2D30rtVKQD7UUANlK2ktu70jp1qG:IMryy90wDMVn/UnNI2SuOp0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4027638.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4027638.exe
Size 307KB
SHA256 e5a5569975594b794264c140bf51d0547dded325311edfdad8b74827f81658ad
MD5 06f49896f2a3df2c78411ef8088b6890
SHA1 a4c1dcbb43a86d9950c3abd7775deb6cbac9fb26
SHA512 5c220f14ed468ca9e59e86cda57f71b4c4f7438709b83f9df15986e3dd5393c1a4c1422494d8c25d8d205997606b7ba79ca940025e0df4eb4c658364d0350f93
SSDEEP 6144:Kcy+bnr+Sp0yN90QE2D30rtVKQD7UUANlK2ktu70jp1qG:IMryy90wDMVn/UnNI2SuOp0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

g9422422.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422422.exe
Size 136KB
SHA256 9ce749d816536d8e59910591993cf8bd4b19ed756887c786d647a1773ed5ad41
MD5 085473d4d7958f2cdc8dcc722246a801
SHA1 fd87fbb7af5dfd265392d08dfd272a1bba8acc38
SHA512 54fe7cd12a95a5dcbc5fc7f19420fa9f6128c405c723d31e0cf14d6f4c6e62e10c119622861d3dc5fe0650aab831486afb898173b03dd1a3f1732164bf2ad035
SSDEEP 1536:BMi4rQ8qOCqm36k0BXlObJt6fh4C5hbV/hN0sA9sYgibfbFDKsRj:OxrQ8qOTF8d64GJd/0sAyYgafJlj
MD5 SHA1 SHA512 SSDEEP

Submit Download

g9422422.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422422.exe
Size 136KB
SHA256 9ce749d816536d8e59910591993cf8bd4b19ed756887c786d647a1773ed5ad41
MD5 085473d4d7958f2cdc8dcc722246a801
SHA1 fd87fbb7af5dfd265392d08dfd272a1bba8acc38
SHA512 54fe7cd12a95a5dcbc5fc7f19420fa9f6128c405c723d31e0cf14d6f4c6e62e10c119622861d3dc5fe0650aab831486afb898173b03dd1a3f1732164bf2ad035
SSDEEP 1536:BMi4rQ8qOCqm36k0BXlObJt6fh4C5hbV/hN0sA9sYgibfbFDKsRj:OxrQ8qOTF8d64GJd/0sAyYgafJlj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-147-0x0000000000D00000-0x0000000000D28000-memory.dmp

Download

memory/368-148-0x00000000080E0000-0x00000000086F8000-memory.dmp

Download

memory/368-149-0x0000000007B50000-0x0000000007B62000-memory.dmp

Download

memory/368-150-0x0000000007C80000-0x0000000007D8A000-memory.dmp

Download

memory/368-151-0x0000000007BB0000-0x0000000007BEC000-memory.dmp

Download

memory/368-152-0x0000000007F60000-0x0000000007F70000-memory.dmp

Download

memory/368-153-0x0000000007F60000-0x0000000007F70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads