redline | 757db050d1c53a834511928b3bb9b673438bc941feace24dcb7e4e212ed436c8

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AI354.exe
Size 1.0MB
Sample230522-hcb6naee43
SHA256 757db050d1c53a834511928b3bb9b673438bc941feace24dcb7e4e212ed436c8
MD5 66e504114737d056cd8617b9a937572c
SHA1 4a1e63f805f15823b979202b0198fa7b513a497f
SHA512 584a72672c06879d85e104f19a603b72512fcf4e4e8395998ec124e6f7b20d0aaa002d229c96eea6d526b8bfbfbd94814d280577d9630cde4f4a81c199323dfa
SSDEEP 24576:fymVk7lp+Nzo+DliXK4MovE7iuj7ocNDgc+3VmkmTxB:qV7l7+Dli7s7iu3NVgcimkmTx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2356	x6338681.exe
4872	x2774460.exe
2840	f3807702.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x2774460.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	AI354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AI354.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6338681.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6338681.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2774460.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2356	1628	AI354.exe	83
PID 1628 wrote to memory of 2356	1628	AI354.exe	83
PID 1628 wrote to memory of 2356	1628	AI354.exe	83
PID 2356 wrote to memory of 4872	2356	x6338681.exe	84
PID 2356 wrote to memory of 4872	2356	x6338681.exe	84
PID 2356 wrote to memory of 4872	2356	x6338681.exe	84
PID 4872 wrote to memory of 2840	4872	x2774460.exe	85
PID 4872 wrote to memory of 2840	4872	x2774460.exe	85
PID 4872 wrote to memory of 2840	4872	x2774460.exe	85

C:\Users\Admin\AppData\Local\Temp\AI354.exe
"C:\Users\Admin\AppData\Local\Temp\AI354.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6338681.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6338681.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2774460.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2774460.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3807702.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3807702.exe
      4⤵
      Executes dropped EXE
      PID:2840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x6338681.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6338681.exe
Size 751KB
SHA256 0c2ababa6313270f791cd18851b4566cd31f73c7f299d189326f0869084f430c
MD5 9c297ebbaac1092aa482fe9162258f4b
SHA1 e0f8b3471e70764d2bf3a71d6ddee43ccc7b4fe5
SHA512 627d6be84cd46fd9ec9786db093cab5fd67c759335f8c45fc648b6bb1a5b61ddb1ce956afe38a596f9c90747bcb31c8694e29be9e4f2f68a13f3bebe370bc439
SSDEEP 12288:bMr+y907En/mqNrdZJ2ZM7QdOulG8c0MDurmWUNruW3Ev/U9hg2POXL/AyL2GZM0:xyduqNioGTlpVDmW0BEE9hgjbbqG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6338681.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6338681.exe
Size 751KB
SHA256 0c2ababa6313270f791cd18851b4566cd31f73c7f299d189326f0869084f430c
MD5 9c297ebbaac1092aa482fe9162258f4b
SHA1 e0f8b3471e70764d2bf3a71d6ddee43ccc7b4fe5
SHA512 627d6be84cd46fd9ec9786db093cab5fd67c759335f8c45fc648b6bb1a5b61ddb1ce956afe38a596f9c90747bcb31c8694e29be9e4f2f68a13f3bebe370bc439
SSDEEP 12288:bMr+y907En/mqNrdZJ2ZM7QdOulG8c0MDurmWUNruW3Ev/U9hg2POXL/AyL2GZM0:xyduqNioGTlpVDmW0BEE9hgjbbqG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2774460.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2774460.exe
Size 306KB
SHA256 8e95cac79dc649723370172ef88386ff1d60d22ecac4c57394f86a128b253c51
MD5 ed4d2a7a5c14cffca312b04242e05d2c
SHA1 b1f32c12d3c10846e4da0dfbf446c75adb7161e2
SHA512 09036bc313ea0bae0201216a6f7886b1cbd90efad6d66bcc59e4baa4fc28ca6338ea3c6545d589089fb0ef8cf2b5c4584ecf301637848957d4e278bebebb7347
SSDEEP 6144:Kuy+bnr+ep0yN90QENtSuQ01Yc2cdOFZulzCq/t0Reh30ZC:SMrOy90lvpaczdOOlG8tiMkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2774460.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2774460.exe
Size 306KB
SHA256 8e95cac79dc649723370172ef88386ff1d60d22ecac4c57394f86a128b253c51
MD5 ed4d2a7a5c14cffca312b04242e05d2c
SHA1 b1f32c12d3c10846e4da0dfbf446c75adb7161e2
SHA512 09036bc313ea0bae0201216a6f7886b1cbd90efad6d66bcc59e4baa4fc28ca6338ea3c6545d589089fb0ef8cf2b5c4584ecf301637848957d4e278bebebb7347
SSDEEP 6144:Kuy+bnr+ep0yN90QENtSuQ01Yc2cdOFZulzCq/t0Reh30ZC:SMrOy90lvpaczdOOlG8tiMkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3807702.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3807702.exe
Size 146KB
SHA256 8540b7bfc18683b6c60a6af0705c19693e6779a95b3e29102561705f7d14bebc
MD5 3f884ee79e1d1ec2b4624445efb05efa
SHA1 3caab32d4a74e7eb7bd4a6f0b27881638c1ab585
SHA512 a22aab82b1b951f818d9a23c3f7a800e8a904222e8cbb1d9ad658a481efb9bb9b18a5dc3e61c9dd5c94df90a7792891226b08066bb968900ea66ba4256430c06
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3807702.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3807702.exe
Size 146KB
SHA256 8540b7bfc18683b6c60a6af0705c19693e6779a95b3e29102561705f7d14bebc
MD5 3f884ee79e1d1ec2b4624445efb05efa
SHA1 3caab32d4a74e7eb7bd4a6f0b27881638c1ab585
SHA512 a22aab82b1b951f818d9a23c3f7a800e8a904222e8cbb1d9ad658a481efb9bb9b18a5dc3e61c9dd5c94df90a7792891226b08066bb968900ea66ba4256430c06
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2840-154-0x0000000000340000-0x000000000036A000-memory.dmp

Download

memory/2840-155-0x00000000052B0000-0x00000000058C8000-memory.dmp

Download

memory/2840-156-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

Download

memory/2840-157-0x0000000004D20000-0x0000000004D32000-memory.dmp

Download

memory/2840-158-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/2840-159-0x0000000004D80000-0x0000000004DBC000-memory.dmp

Download

memory/2840-160-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads