redline | 2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4

Analysis

max time kernel
142s
max time network
194s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe
Size

867KB
MD5

1b0c767ae5b36b84c653e30b0a363a84
SHA1

8fa048c8c24d1e5c840074735fd652f131cdb3b5
SHA256

2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4
SHA512

52bc5f45f3a88b2e838878e8ffb72ee6bf0765b637f02cb7a3baf88cd72a33d22877557a8e9f2c60f64876b6870d59451bd9b6869f4e96926e8038a917658593
SSDEEP

12288:ry909VXDNBX9dJkUO2suke//brqLk/igt5a3mxoc7m7oBQ+aZuQBSjgSFDS:ryAxBX9dJkWae/6gtchKicQEj1Fm

Score

10^/10

redline dark gena infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
908	y23994156.exe
1760	p00393628.exe
1948	1.exe
1096	r61456080.exe

Loads dropped DLL 9 IoCs

pid	Process
1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe
908	y23994156.exe
908	y23994156.exe
908	y23994156.exe
1760	p00393628.exe
1760	p00393628.exe
1948	1.exe
908	y23994156.exe
1096	r61456080.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y23994156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y23994156.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	p00393628.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 1804 wrote to memory of 908	1804	2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe	28
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 908 wrote to memory of 1760	908	y23994156.exe	29
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 1760 wrote to memory of 1948	1760	p00393628.exe	30
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31
PID 908 wrote to memory of 1096	908	y23994156.exe	31

C:\Users\Admin\AppData\Local\Temp\2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe
"C:\Users\Admin\AppData\Local\Temp\2a47a07a63e9d720fbf21b7da50a306e4f798fbdc47dd347c91f92153629cbc4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1948
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe

Filesize
578KB

MD5
661c04b1d9476c38caaac408c9eebacc

SHA1
3bb7e0e2fe716181ca905224fcf0b09632def5fd

SHA256
7402f02de5de1d1040092c7fdb9b7b96ccbd70d41ff3b9eea7ec169826921fd0

SHA512
05d3a0f41976c287f67c660b340659815e86b0a05947d6bcc3fed1b0807c93d6534399795df96aef0e99899f66e3968f83bd35f3c207afc4c9d55d1a0ccc7b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe

Filesize
578KB

MD5
661c04b1d9476c38caaac408c9eebacc

SHA1
3bb7e0e2fe716181ca905224fcf0b09632def5fd

SHA256
7402f02de5de1d1040092c7fdb9b7b96ccbd70d41ff3b9eea7ec169826921fd0

SHA512
05d3a0f41976c287f67c660b340659815e86b0a05947d6bcc3fed1b0807c93d6534399795df96aef0e99899f66e3968f83bd35f3c207afc4c9d55d1a0ccc7b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe

Filesize
172KB

MD5
d4537f60304c8e71b27e47bfcca3f5fe

SHA1
b7514b3aa69d20c301acc81bc32c77d6272af0fb

SHA256
584a546ef1a64e1444d756a6cfa7d55b7ea918927c6322e35af35c48d05f631f

SHA512
15fd8ff5300f75371163575dc9f8516e187eb5d7a21738e86679b87fd21163face7ab2732e12d09505223eca24c11eb9e6a0df8a153c3ab9a851a2acccb0e8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe

Filesize
172KB

MD5
d4537f60304c8e71b27e47bfcca3f5fe

SHA1
b7514b3aa69d20c301acc81bc32c77d6272af0fb

SHA256
584a546ef1a64e1444d756a6cfa7d55b7ea918927c6322e35af35c48d05f631f

SHA512
15fd8ff5300f75371163575dc9f8516e187eb5d7a21738e86679b87fd21163face7ab2732e12d09505223eca24c11eb9e6a0df8a153c3ab9a851a2acccb0e8e6

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe

Filesize
578KB

MD5
661c04b1d9476c38caaac408c9eebacc

SHA1
3bb7e0e2fe716181ca905224fcf0b09632def5fd

SHA256
7402f02de5de1d1040092c7fdb9b7b96ccbd70d41ff3b9eea7ec169826921fd0

SHA512
05d3a0f41976c287f67c660b340659815e86b0a05947d6bcc3fed1b0807c93d6534399795df96aef0e99899f66e3968f83bd35f3c207afc4c9d55d1a0ccc7b2d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y23994156.exe

Filesize
578KB

MD5
661c04b1d9476c38caaac408c9eebacc

SHA1
3bb7e0e2fe716181ca905224fcf0b09632def5fd

SHA256
7402f02de5de1d1040092c7fdb9b7b96ccbd70d41ff3b9eea7ec169826921fd0

SHA512
05d3a0f41976c287f67c660b340659815e86b0a05947d6bcc3fed1b0807c93d6534399795df96aef0e99899f66e3968f83bd35f3c207afc4c9d55d1a0ccc7b2d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00393628.exe

Filesize
580KB

MD5
d8b66aa51a092b703517007b37d3101c

SHA1
fe0029f02cebb098ef9e98ef1a2abc0ee93ac456

SHA256
8e3f62df2d0358488e616af22e02685fb917baf8b078e04b2833ff87c9e5d198

SHA512
9cd16f1e5605a3181ebd771606f9f2fe5ac01a10f9cf730b98c882de0a978f699afd8eb840ca6863ec83b32e2adcfbc17a63ff8ad69d207492fa8f44cf0eddcf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe

Filesize
172KB

MD5
d4537f60304c8e71b27e47bfcca3f5fe

SHA1
b7514b3aa69d20c301acc81bc32c77d6272af0fb

SHA256
584a546ef1a64e1444d756a6cfa7d55b7ea918927c6322e35af35c48d05f631f

SHA512
15fd8ff5300f75371163575dc9f8516e187eb5d7a21738e86679b87fd21163face7ab2732e12d09505223eca24c11eb9e6a0df8a153c3ab9a851a2acccb0e8e6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r61456080.exe

Filesize
172KB

MD5
d4537f60304c8e71b27e47bfcca3f5fe

SHA1
b7514b3aa69d20c301acc81bc32c77d6272af0fb

SHA256
584a546ef1a64e1444d756a6cfa7d55b7ea918927c6322e35af35c48d05f631f

SHA512
15fd8ff5300f75371163575dc9f8516e187eb5d7a21738e86679b87fd21163face7ab2732e12d09505223eca24c11eb9e6a0df8a153c3ab9a851a2acccb0e8e6

Download Submit
\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/1096-2252-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/1096-2247-0x0000000000800000-0x0000000000830000-memory.dmp

Filesize
192KB

Download
memory/1096-2248-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1096-2250-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/1760-117-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/1760-142-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-103-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-105-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-107-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-109-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-111-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-114-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-115-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/1760-113-0x0000000000840000-0x000000000089B000-memory.dmp

Filesize
364KB

Download
memory/1760-99-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-118-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-120-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-122-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-124-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-126-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-130-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-128-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-132-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-134-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-140-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-101-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-138-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-136-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-146-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-144-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-2229-0x00000000009B0000-0x00000000009E2000-memory.dmp

Filesize
200KB

Download
memory/1760-95-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-97-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-93-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-91-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-78-0x0000000002720000-0x0000000002788000-memory.dmp

Filesize
416KB

Download
memory/1760-89-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-87-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-85-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-79-0x0000000002630000-0x0000000002696000-memory.dmp

Filesize
408KB

Download
memory/1760-83-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-81-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1760-80-0x0000000002630000-0x0000000002690000-memory.dmp

Filesize
384KB

Download
memory/1948-2249-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/1948-2246-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1948-2251-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/1948-2239-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads