redline | fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-05-2023 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe
Size

1.5MB
MD5

42d59a8aa905c4a5def8b44ee4fc31e9
SHA1

ed29fc03b9d8f2ea1b8f2bb40784af1f70853ec2
SHA256

fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181
SHA512

70b51dedf41a9d0a7b8e0ff9e16fa506e2ed49638aee569afecae77aeead1a4a2fde5ba95479db2b69a607bd901757744663d19f9eecf0c57aa26a257a194edf
SSDEEP

24576:Fy1UFlz//dgbT2SIgRc1FazjZhc1bj051H9xIBCv6ON6maizAWXDGQcNXBlzWQ:gaFlz3aKjfihc1bSUgCM6maeuNxl

Score

10^/10

redline most infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 5 IoCs

Processes:

i78278696.exei36267585.exei74214195.exei23129162.exea90305329.exe

pid process

1344 i78278696.exe
1060 i36267585.exe
648 i74214195.exe
580 i23129162.exe
1220 a90305329.exe

pid	process
1344	i78278696.exe
1060	i36267585.exe
648	i74214195.exe
580	i23129162.exe
1220	a90305329.exe

Loads dropped DLL 10 IoCs

Processes:

fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exei78278696.exei36267585.exei74214195.exei23129162.exea90305329.exe

pid	process
848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe
1344	i78278696.exe
1344	i78278696.exe
1060	i36267585.exe
1060	i36267585.exe
648	i74214195.exe
648	i74214195.exe
580	i23129162.exe
580	i23129162.exe
1220	a90305329.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exei23129162.exei78278696.exei36267585.exei74214195.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	i23129162.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i23129162.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	i78278696.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i78278696.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	i36267585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i36267585.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	i74214195.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i74214195.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exei78278696.exei36267585.exei74214195.exei23129162.exe

description	pid	process	target process
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 848 wrote to memory of 1344	848	fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe	i78278696.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1344 wrote to memory of 1060	1344	i78278696.exe	i36267585.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 1060 wrote to memory of 648	1060	i36267585.exe	i74214195.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 648 wrote to memory of 580	648	i74214195.exe	i23129162.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe
PID 580 wrote to memory of 1220	580	i23129162.exe	a90305329.exe

C:\Users\Admin\AppData\Local\Temp\fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe
"C:\Users\Admin\AppData\Local\Temp\fd2cef82fd2f78f76f25a4b99fd1013e23a9cffffd36887f223e2915f6711181.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1060

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
Filesize
1.3MB

MD5
40b4680900bf059e0c7c05c2f91478bf

SHA1
570fa5a29c799c45c87e21433bf9719a0b817231

SHA256
620707b8acd8717ae02b1d403a4286149630e0cbbd826b5fb449cb09293af7d1

SHA512
f95accb3ddb4162208037303ef45ce837717a9b91efed63fbe2abc05258457eadc678096c0f024939148741f5fe0a4389ec7764b08939b927d5eb85532c19b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
Filesize
1.3MB

MD5
40b4680900bf059e0c7c05c2f91478bf

SHA1
570fa5a29c799c45c87e21433bf9719a0b817231

SHA256
620707b8acd8717ae02b1d403a4286149630e0cbbd826b5fb449cb09293af7d1

SHA512
f95accb3ddb4162208037303ef45ce837717a9b91efed63fbe2abc05258457eadc678096c0f024939148741f5fe0a4389ec7764b08939b927d5eb85532c19b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
Filesize
1015KB

MD5
2c9547ec6543dcda30ebfeac98aa8827

SHA1
f22e3f93cb6a7605abc3f2253586851d99b90880

SHA256
238bfb371906132855551fb74b1e946c9646ae51308cfc9d76c5dc525e5d9d0d

SHA512
32de1f0bf021026d63985db0d6abb625f8dbc45adec5463e379dd422d94d278cd71d6b0b9275790f744cdc32868a45e06baafc9de1e45eddbf8f709addc5b5cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
Filesize
1015KB

MD5
2c9547ec6543dcda30ebfeac98aa8827

SHA1
f22e3f93cb6a7605abc3f2253586851d99b90880

SHA256
238bfb371906132855551fb74b1e946c9646ae51308cfc9d76c5dc525e5d9d0d

SHA512
32de1f0bf021026d63985db0d6abb625f8dbc45adec5463e379dd422d94d278cd71d6b0b9275790f744cdc32868a45e06baafc9de1e45eddbf8f709addc5b5cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
Filesize
843KB

MD5
a8c56cf5ef0d9b9c8ed4c3ec019370c6

SHA1
425bef38956604327bd4018830462aa9260e1432

SHA256
36516b4c824dc05f5c05969ab3e55322938cc31c3e33d98b1721f2c7c88d97f0

SHA512
baffdc421debddf1804455b5e769cdb61986c78179c83a87de561550f4decc40e5c7605cb84f9401dc1189da578d88ae8e4151f0e1c1e87a9c2fbe646f6b752b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
Filesize
843KB

MD5
a8c56cf5ef0d9b9c8ed4c3ec019370c6

SHA1
425bef38956604327bd4018830462aa9260e1432

SHA256
36516b4c824dc05f5c05969ab3e55322938cc31c3e33d98b1721f2c7c88d97f0

SHA512
baffdc421debddf1804455b5e769cdb61986c78179c83a87de561550f4decc40e5c7605cb84f9401dc1189da578d88ae8e4151f0e1c1e87a9c2fbe646f6b752b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
Filesize
371KB

MD5
cad9fd29803de9feced521c3eb9bda41

SHA1
b81c1c77170901a031068baf7f216c33bec741b8

SHA256
346c4bbffe89bc31f03bd8d907bbdd6710ab8c07d20d3b6d72effd69c1f14c7e

SHA512
7cab88ba46678efc23ee6659c11f640fb7baa5203c3dc9be2a086958df241e20870b01df92bced27249f0ca6f16cd01e8c9e2cbaa3cb898d9346df03fe40e574

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
Filesize
371KB

MD5
cad9fd29803de9feced521c3eb9bda41

SHA1
b81c1c77170901a031068baf7f216c33bec741b8

SHA256
346c4bbffe89bc31f03bd8d907bbdd6710ab8c07d20d3b6d72effd69c1f14c7e

SHA512
7cab88ba46678efc23ee6659c11f640fb7baa5203c3dc9be2a086958df241e20870b01df92bced27249f0ca6f16cd01e8c9e2cbaa3cb898d9346df03fe40e574

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
Filesize
169KB

MD5
76eef94c5c11cd4f1d75cc428bef0402

SHA1
6a6c8badb881ba064399ae902f22413a402ef6c6

SHA256
a5663be99714cd2becfbd1e897d79a9330d4ec9d0adb970bf72a0cac467b919a

SHA512
a7bb102ab95800ce5b942a03ffaa0092c103cee62c7bf5e0e08e63d4b3ecbd75e5e86c9ab64ba82d60132e836a74a3ecc5bd1464cf3dad873795992eeca43e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
Filesize
169KB

MD5
76eef94c5c11cd4f1d75cc428bef0402

SHA1
6a6c8badb881ba064399ae902f22413a402ef6c6

SHA256
a5663be99714cd2becfbd1e897d79a9330d4ec9d0adb970bf72a0cac467b919a

SHA512
a7bb102ab95800ce5b942a03ffaa0092c103cee62c7bf5e0e08e63d4b3ecbd75e5e86c9ab64ba82d60132e836a74a3ecc5bd1464cf3dad873795992eeca43e04

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
Filesize
1.3MB

MD5
40b4680900bf059e0c7c05c2f91478bf

SHA1
570fa5a29c799c45c87e21433bf9719a0b817231

SHA256
620707b8acd8717ae02b1d403a4286149630e0cbbd826b5fb449cb09293af7d1

SHA512
f95accb3ddb4162208037303ef45ce837717a9b91efed63fbe2abc05258457eadc678096c0f024939148741f5fe0a4389ec7764b08939b927d5eb85532c19b26

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\i78278696.exe
Filesize
1.3MB

MD5
40b4680900bf059e0c7c05c2f91478bf

SHA1
570fa5a29c799c45c87e21433bf9719a0b817231

SHA256
620707b8acd8717ae02b1d403a4286149630e0cbbd826b5fb449cb09293af7d1

SHA512
f95accb3ddb4162208037303ef45ce837717a9b91efed63fbe2abc05258457eadc678096c0f024939148741f5fe0a4389ec7764b08939b927d5eb85532c19b26

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
Filesize
1015KB

MD5
2c9547ec6543dcda30ebfeac98aa8827

SHA1
f22e3f93cb6a7605abc3f2253586851d99b90880

SHA256
238bfb371906132855551fb74b1e946c9646ae51308cfc9d76c5dc525e5d9d0d

SHA512
32de1f0bf021026d63985db0d6abb625f8dbc45adec5463e379dd422d94d278cd71d6b0b9275790f744cdc32868a45e06baafc9de1e45eddbf8f709addc5b5cd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36267585.exe
Filesize
1015KB

MD5
2c9547ec6543dcda30ebfeac98aa8827

SHA1
f22e3f93cb6a7605abc3f2253586851d99b90880

SHA256
238bfb371906132855551fb74b1e946c9646ae51308cfc9d76c5dc525e5d9d0d

SHA512
32de1f0bf021026d63985db0d6abb625f8dbc45adec5463e379dd422d94d278cd71d6b0b9275790f744cdc32868a45e06baafc9de1e45eddbf8f709addc5b5cd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
Filesize
843KB

MD5
a8c56cf5ef0d9b9c8ed4c3ec019370c6

SHA1
425bef38956604327bd4018830462aa9260e1432

SHA256
36516b4c824dc05f5c05969ab3e55322938cc31c3e33d98b1721f2c7c88d97f0

SHA512
baffdc421debddf1804455b5e769cdb61986c78179c83a87de561550f4decc40e5c7605cb84f9401dc1189da578d88ae8e4151f0e1c1e87a9c2fbe646f6b752b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\i74214195.exe
Filesize
843KB

MD5
a8c56cf5ef0d9b9c8ed4c3ec019370c6

SHA1
425bef38956604327bd4018830462aa9260e1432

SHA256
36516b4c824dc05f5c05969ab3e55322938cc31c3e33d98b1721f2c7c88d97f0

SHA512
baffdc421debddf1804455b5e769cdb61986c78179c83a87de561550f4decc40e5c7605cb84f9401dc1189da578d88ae8e4151f0e1c1e87a9c2fbe646f6b752b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
Filesize
371KB

MD5
cad9fd29803de9feced521c3eb9bda41

SHA1
b81c1c77170901a031068baf7f216c33bec741b8

SHA256
346c4bbffe89bc31f03bd8d907bbdd6710ab8c07d20d3b6d72effd69c1f14c7e

SHA512
7cab88ba46678efc23ee6659c11f640fb7baa5203c3dc9be2a086958df241e20870b01df92bced27249f0ca6f16cd01e8c9e2cbaa3cb898d9346df03fe40e574

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\i23129162.exe
Filesize
371KB

MD5
cad9fd29803de9feced521c3eb9bda41

SHA1
b81c1c77170901a031068baf7f216c33bec741b8

SHA256
346c4bbffe89bc31f03bd8d907bbdd6710ab8c07d20d3b6d72effd69c1f14c7e

SHA512
7cab88ba46678efc23ee6659c11f640fb7baa5203c3dc9be2a086958df241e20870b01df92bced27249f0ca6f16cd01e8c9e2cbaa3cb898d9346df03fe40e574

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
Filesize
169KB

MD5
76eef94c5c11cd4f1d75cc428bef0402

SHA1
6a6c8badb881ba064399ae902f22413a402ef6c6

SHA256
a5663be99714cd2becfbd1e897d79a9330d4ec9d0adb970bf72a0cac467b919a

SHA512
a7bb102ab95800ce5b942a03ffaa0092c103cee62c7bf5e0e08e63d4b3ecbd75e5e86c9ab64ba82d60132e836a74a3ecc5bd1464cf3dad873795992eeca43e04

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\a90305329.exe
Filesize
169KB

MD5
76eef94c5c11cd4f1d75cc428bef0402

SHA1
6a6c8badb881ba064399ae902f22413a402ef6c6

SHA256
a5663be99714cd2becfbd1e897d79a9330d4ec9d0adb970bf72a0cac467b919a

SHA512
a7bb102ab95800ce5b942a03ffaa0092c103cee62c7bf5e0e08e63d4b3ecbd75e5e86c9ab64ba82d60132e836a74a3ecc5bd1464cf3dad873795992eeca43e04

Download Submit
memory/1220-104-0x0000000000ED0000-0x0000000000F00000-memory.dmp

Filesize
192KB

Download
memory/1220-105-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1220-106-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/1220-107-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download