redline | b1b818f4050215f7dd6341a7684e37244d8f286315df0e6d850d65c1cdd0fb34

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21324777.exe
Size 1.0MB
Sample230522-msvp6afg39
SHA256 b1b818f4050215f7dd6341a7684e37244d8f286315df0e6d850d65c1cdd0fb34
MD5 37857f6634adc2e3ab6e6c521eaa0457
SHA1 c43cd27a7a3aa98527a54131e14a8234d82ead38
SHA512 67a6c0660517b416e2613430fcfdfacec2e7e35ec30a11573fc475ffd318e55f96d24a09dd62ee813838f81d0a93725a3fc2fcb488db5aed3016b6746021dc33
SSDEEP 24576:By8bX9W4YV+HmFrOHHiD3eRw05dIATH/mc+:04m1cHFRw6djTH/mc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
380	x1720462.exe
920	x6732117.exe
2544	f8531036.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	21324777.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	21324777.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1720462.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1720462.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6732117.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6732117.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 380	4380	21324777.exe	84
PID 4380 wrote to memory of 380	4380	21324777.exe	84
PID 4380 wrote to memory of 380	4380	21324777.exe	84
PID 380 wrote to memory of 920	380	x1720462.exe	85
PID 380 wrote to memory of 920	380	x1720462.exe	85
PID 380 wrote to memory of 920	380	x1720462.exe	85
PID 920 wrote to memory of 2544	920	x6732117.exe	86
PID 920 wrote to memory of 2544	920	x6732117.exe	86
PID 920 wrote to memory of 2544	920	x6732117.exe	86

C:\Users\Admin\AppData\Local\Temp\21324777.exe
"C:\Users\Admin\AppData\Local\Temp\21324777.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1720462.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1720462.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6732117.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6732117.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8531036.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8531036.exe
      4⤵
      Executes dropped EXE
      PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1720462.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1720462.exe
Size 751KB
SHA256 3ea3745b60b20b28c7ac7d93b1195ed761d9b24f3514f0152056650e7a11e550
MD5 542193ae0254e80f0bdc8c29ca2754f8
SHA1 b6a4455d9352ad823df20609356f9ebbc9619e78
SHA512 291ae06fbdfa6d98d8d7a3989b1f470960da42080c9f8aeda5e88366a3dde84d062f2cf51db571119512900aa8b681f23b4a17a96299d6d9e32ea8f4c6d9768a
SSDEEP 12288:7Mrey90MGYCqao6V+5TJqHyFNKCImZHpwh+qmD41+mfWhtggVTUBV0dxZy7:Vyl8o6V3HyFNzIhyDsUhtggV4Id/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1720462.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1720462.exe
Size 751KB
SHA256 3ea3745b60b20b28c7ac7d93b1195ed761d9b24f3514f0152056650e7a11e550
MD5 542193ae0254e80f0bdc8c29ca2754f8
SHA1 b6a4455d9352ad823df20609356f9ebbc9619e78
SHA512 291ae06fbdfa6d98d8d7a3989b1f470960da42080c9f8aeda5e88366a3dde84d062f2cf51db571119512900aa8b681f23b4a17a96299d6d9e32ea8f4c6d9768a
SSDEEP 12288:7Mrey90MGYCqao6V+5TJqHyFNKCImZHpwh+qmD41+mfWhtggVTUBV0dxZy7:Vyl8o6V3HyFNzIhyDsUhtggV4Id/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6732117.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6732117.exe
Size 306KB
SHA256 c37b98812c8cc35818f24e8338dddd33ea49a517d7d301c34a32d0c13c93232c
MD5 f4859bf1c5074f67b5d6d1c1f8c3e6be
SHA1 52a09eb2dc29cd1b508ef70bd3bfb5d798aacba8
SHA512 e4a7fc27016bc708074c62daa499b67721089ed41b61da81376bddf87775f1d37687a29fe697beb5cde2b3f3fd69736be6b58f8f5f7d6ee44176f5eb7ae0ccc0
SSDEEP 6144:KYy+bnr+Rp0yN90QEttSuQ01aexn83ClBhtbJho6j:IMrly90VvpkmKClrZHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6732117.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6732117.exe
Size 306KB
SHA256 c37b98812c8cc35818f24e8338dddd33ea49a517d7d301c34a32d0c13c93232c
MD5 f4859bf1c5074f67b5d6d1c1f8c3e6be
SHA1 52a09eb2dc29cd1b508ef70bd3bfb5d798aacba8
SHA512 e4a7fc27016bc708074c62daa499b67721089ed41b61da81376bddf87775f1d37687a29fe697beb5cde2b3f3fd69736be6b58f8f5f7d6ee44176f5eb7ae0ccc0
SSDEEP 6144:KYy+bnr+Rp0yN90QEttSuQ01aexn83ClBhtbJho6j:IMrly90VvpkmKClrZHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8531036.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8531036.exe
Size 146KB
SHA256 2c0e49af0e1772277faee202932823cea84e3b85b1d87c4df766a1dca1a88513
MD5 ac2ab2c3c82d148d45e95cfdd5c03749
SHA1 745942d02d19450deb3c66b54abefa4998cb9e2a
SHA512 4cf8c7f46f9f8a9c5bf10965264fd2583cb8f5a038763314e5156c9a6923698ecded903ab472932606e1bdf1cea3d440b399e3812872f704a54ddc4b32c472a5
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8531036.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8531036.exe
Size 146KB
SHA256 2c0e49af0e1772277faee202932823cea84e3b85b1d87c4df766a1dca1a88513
MD5 ac2ab2c3c82d148d45e95cfdd5c03749
SHA1 745942d02d19450deb3c66b54abefa4998cb9e2a
SHA512 4cf8c7f46f9f8a9c5bf10965264fd2583cb8f5a038763314e5156c9a6923698ecded903ab472932606e1bdf1cea3d440b399e3812872f704a54ddc4b32c472a5
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2544-154-0x00000000008D0000-0x00000000008FA000-memory.dmp

Download

memory/2544-155-0x00000000057F0000-0x0000000005E08000-memory.dmp

Download

memory/2544-156-0x0000000005370000-0x000000000547A000-memory.dmp

Download

memory/2544-157-0x00000000052A0000-0x00000000052B2000-memory.dmp

Download

memory/2544-158-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/2544-159-0x0000000005330000-0x000000000536C000-memory.dmp

Download

memory/2544-160-0x0000000005320000-0x0000000005330000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads