redline | 6d8f3419d1a4bbacdc3b41336a8690cfb2f90fa7e5c86785a4a676df9bb8784f

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.0MB
Sample230522-af279afh4t
SHA256 6d8f3419d1a4bbacdc3b41336a8690cfb2f90fa7e5c86785a4a676df9bb8784f
MD5 ded040027e98d0cebdc067d5abc81fe8
SHA1 202644f8db6d0efc1edd2177585f92f12b3613d9
SHA512 81c534601fa760941967a3235f45bed3262fb5f09b4f7c9df8e1243400da905621aed69cbd92de32b0a03fb6e79793c31e204271deb2735046288bfdda9941e0
SSDEEP 24576:iye4qEZ8KFB/klG+niI5yjG20qRTpv8TKwP5+/VhNrbR:JWEZ8Kvl+T5qRcj5eV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4084	x5410294.exe
560	x5454241.exe
4536	f2402122.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5454241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5454241.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5410294.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5410294.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4084	4364	file.exe	86
PID 4364 wrote to memory of 4084	4364	file.exe	86
PID 4364 wrote to memory of 4084	4364	file.exe	86
PID 4084 wrote to memory of 560	4084	x5410294.exe	87
PID 4084 wrote to memory of 560	4084	x5410294.exe	87
PID 4084 wrote to memory of 560	4084	x5410294.exe	87
PID 560 wrote to memory of 4536	560	x5454241.exe	88
PID 560 wrote to memory of 4536	560	x5454241.exe	88
PID 560 wrote to memory of 4536	560	x5454241.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5410294.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5410294.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5454241.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5454241.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2402122.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2402122.exe
      4⤵
      Executes dropped EXE
      PID:4536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5410294.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5410294.exe
Size 750KB
SHA256 10bcb5b536086b28805af0d4cf7814b900a6cdc0e8dc5a7c9ebf20dc208757cc
MD5 c61f3a1a877b8cfc62a10a0e685ce17e
SHA1 2f53b2b951f2caa5a537434686e263fb1e7fdaf4
SHA512 b21dcc28c310c5aa2020988c9919887289d0238c96dc77689aee50ab77fb48e2e6ccf102ed9f0c092aecb18e5e0292c55a80c0ffd1d15d52cbbae2b12d5727d4
SSDEEP 12288:oMrAy90vFS1kJTTkpGiI13+aaivFZH+lxcOjpEXjq2+IqqQw6NFPgHcwdyr8hfq6:IyaF1fkaB+bXkWyjq2xqu6vwdyQQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5410294.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5410294.exe
Size 750KB
SHA256 10bcb5b536086b28805af0d4cf7814b900a6cdc0e8dc5a7c9ebf20dc208757cc
MD5 c61f3a1a877b8cfc62a10a0e685ce17e
SHA1 2f53b2b951f2caa5a537434686e263fb1e7fdaf4
SHA512 b21dcc28c310c5aa2020988c9919887289d0238c96dc77689aee50ab77fb48e2e6ccf102ed9f0c092aecb18e5e0292c55a80c0ffd1d15d52cbbae2b12d5727d4
SSDEEP 12288:oMrAy90vFS1kJTTkpGiI13+aaivFZH+lxcOjpEXjq2+IqqQw6NFPgHcwdyr8hfq6:IyaF1fkaB+bXkWyjq2xqu6vwdyQQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5454241.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5454241.exe
Size 306KB
SHA256 3557bf7985ecb1c07a99c0959f4c09424d2450a8d0197f123e53a04712e73d49
MD5 ad1f281b4ac90c895a1e7e548cd1a211
SHA1 f663b80ec9850c1f7a18103a2e1e25ec49dfc1de
SHA512 28ed33e4617aedfc3f9b010384a02e26f0b72c571c43d6dc680598a7b7cf75667e47550dd66f2cf70fae042d1ddea73df995daf2420927e42667505e3e1d889c
SSDEEP 6144:K/y+bnr+ep0yN90QEptSuQ01EBp9CXbuOTou3+aqeiygXtbJho1:dMrGy90NvpSB3EyO33+apivXZHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5454241.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5454241.exe
Size 306KB
SHA256 3557bf7985ecb1c07a99c0959f4c09424d2450a8d0197f123e53a04712e73d49
MD5 ad1f281b4ac90c895a1e7e548cd1a211
SHA1 f663b80ec9850c1f7a18103a2e1e25ec49dfc1de
SHA512 28ed33e4617aedfc3f9b010384a02e26f0b72c571c43d6dc680598a7b7cf75667e47550dd66f2cf70fae042d1ddea73df995daf2420927e42667505e3e1d889c
SSDEEP 6144:K/y+bnr+ep0yN90QEptSuQ01EBp9CXbuOTou3+aqeiygXtbJho1:dMrGy90NvpSB3EyO33+apivXZHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2402122.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2402122.exe
Size 145KB
SHA256 0b15a0a019e6712b50abb2b358ec24166de905e69d55d96494f979cb43d3e7e6
MD5 82f9d522212c7d45df9771618be0639a
SHA1 5758eda766901fe52e2d83d03dfdd67b3a332755
SHA512 9b2e52269c4afa613df6aaff42d237bffd1bc32e4b427d5d30d1b5c20ceae952e23e12fc710ed5e04d348cf22aa1fb3b5829752c0bb1f679858b4e8f2218efcb
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2402122.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2402122.exe
Size 145KB
SHA256 0b15a0a019e6712b50abb2b358ec24166de905e69d55d96494f979cb43d3e7e6
MD5 82f9d522212c7d45df9771618be0639a
SHA1 5758eda766901fe52e2d83d03dfdd67b3a332755
SHA512 9b2e52269c4afa613df6aaff42d237bffd1bc32e4b427d5d30d1b5c20ceae952e23e12fc710ed5e04d348cf22aa1fb3b5829752c0bb1f679858b4e8f2218efcb
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4536-154-0x0000000000350000-0x000000000037A000-memory.dmp

Download

memory/4536-155-0x0000000005270000-0x0000000005888000-memory.dmp

Download

memory/4536-156-0x0000000004DF0000-0x0000000004EFA000-memory.dmp

Download

memory/4536-157-0x0000000004D20000-0x0000000004D32000-memory.dmp

Download

memory/4536-158-0x0000000004F00000-0x0000000004F3C000-memory.dmp

Download

memory/4536-159-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Download

memory/4536-160-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads