redline | e53bd8d9458c25d81bfcfd7a9a03572429e86d80d7829ec1e3c24556dfff3f1b

General

Target

42345.exe
Size

1.0MB
MD5

15c0d4b500ecdb0536b7af315d9be0bf
SHA1

2eb39fdf2e3cf66765e021e26890dc493623c21b
SHA256

e53bd8d9458c25d81bfcfd7a9a03572429e86d80d7829ec1e3c24556dfff3f1b
SHA512

3ca185cf616210c51e06eac12984509922c8971126c58f187c9e189089a3ea2085b0f2c15e07e43896c25a02e0ff5761ce28a3dd91acdc6d131985ee144f7515
SSDEEP

24576:tyhHVPtyp93KZrj94MdDHkCTzGJLnnE8I:I3Ptw93KDLDgJLnE8

Score

10^/10

redline deren infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

deren

C2

77.91.68.253:19065

Attributes

auth_value
04a169f1fb198bfbeca74d0e06ea2d54

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1148	x6435173.exe
2152	x4049756.exe
4364	f1039246.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	42345.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	42345.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6435173.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6435173.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4049756.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4049756.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1148	2056	42345.exe	83
PID 2056 wrote to memory of 1148	2056	42345.exe	83
PID 2056 wrote to memory of 1148	2056	42345.exe	83
PID 1148 wrote to memory of 2152	1148	x6435173.exe	84
PID 1148 wrote to memory of 2152	1148	x6435173.exe	84
PID 1148 wrote to memory of 2152	1148	x6435173.exe	84
PID 2152 wrote to memory of 4364	2152	x4049756.exe	85
PID 2152 wrote to memory of 4364	2152	x4049756.exe	85
PID 2152 wrote to memory of 4364	2152	x4049756.exe	85

C:\Users\Admin\AppData\Local\Temp\42345.exe
"C:\Users\Admin\AppData\Local\Temp\42345.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6435173.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6435173.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4049756.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4049756.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f1039246.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f1039246.exe
      4⤵
      Executes dropped EXE
      PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6435173.exe

Filesize
750KB

MD5
90fc01bdd645c5f7f82bc5b8bc39e29f

SHA1
6d418c369fa8dcc0a8da5076280f15a61691a679

SHA256
ce84dc20226727aa4090951977dfa2da19cb6d0a3aa0128df58bfb06a1fb2258

SHA512
8f274c9812f28629a16e747c3845e81632eef0b3418318d5981ebcc6554f9b539e7adc8327eac8990de0326c23a5f950f4bec910e0a0c5e1f2761ce26abd5baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6435173.exe

Filesize
750KB

MD5
90fc01bdd645c5f7f82bc5b8bc39e29f

SHA1
6d418c369fa8dcc0a8da5076280f15a61691a679

SHA256
ce84dc20226727aa4090951977dfa2da19cb6d0a3aa0128df58bfb06a1fb2258

SHA512
8f274c9812f28629a16e747c3845e81632eef0b3418318d5981ebcc6554f9b539e7adc8327eac8990de0326c23a5f950f4bec910e0a0c5e1f2761ce26abd5baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4049756.exe

Filesize
305KB

MD5
9de479606736d49466229ec51b9fc523

SHA1
d9b574bb9032a29998d9245c6118fda579d6ae1e

SHA256
1a5c3c70c1d2dc38822fa10c6829efaaa8a2ba7e481d208b92170276eba607b6

SHA512
3128e51c18ef3510768f13f8ec299b530ef53d1fc244b1a258e9123b96771ceb53269fe60d4fe4ab846e67aa6f37cd4853a0173f0f22d004774c086cd5f64441

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4049756.exe

Filesize
305KB

MD5
9de479606736d49466229ec51b9fc523

SHA1
d9b574bb9032a29998d9245c6118fda579d6ae1e

SHA256
1a5c3c70c1d2dc38822fa10c6829efaaa8a2ba7e481d208b92170276eba607b6

SHA512
3128e51c18ef3510768f13f8ec299b530ef53d1fc244b1a258e9123b96771ceb53269fe60d4fe4ab846e67aa6f37cd4853a0173f0f22d004774c086cd5f64441

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f1039246.exe

Filesize
145KB

MD5
7148cc54fcd017f53284620c64210e57

SHA1
cc60f88150eb26541931c783184676da30e630c9

SHA256
bb3e4e3486921a9fee3b92dac969bc51b1bf2f292ecd088ba590e08c80912fde

SHA512
999376fc0d70df5a4fbabd7a56fc6be6e0f81b22b0ca1a1498764fa146baf72111b02b562192c02fdd47091e48b6857f0f6c1e3ce9e5fd0e12cafd50fbf11312

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f1039246.exe

Filesize
145KB

MD5
7148cc54fcd017f53284620c64210e57

SHA1
cc60f88150eb26541931c783184676da30e630c9

SHA256
bb3e4e3486921a9fee3b92dac969bc51b1bf2f292ecd088ba590e08c80912fde

SHA512
999376fc0d70df5a4fbabd7a56fc6be6e0f81b22b0ca1a1498764fa146baf72111b02b562192c02fdd47091e48b6857f0f6c1e3ce9e5fd0e12cafd50fbf11312

Download Submit
memory/4364-154-0x0000000000070000-0x000000000009A000-memory.dmp

Filesize
168KB

Download
memory/4364-155-0x0000000005030000-0x0000000005648000-memory.dmp

Filesize
6.1MB

Download
memory/4364-156-0x0000000004B20000-0x0000000004C2A000-memory.dmp

Filesize
1.0MB

Download
memory/4364-157-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4364-158-0x0000000004AD0000-0x0000000004B0C000-memory.dmp

Filesize
240KB

Download
memory/4364-159-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

Filesize
64KB

Download
memory/4364-160-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing