redline | f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
245245254202.exe
Size 1.0MB
Sample230522-mswmfsae4y
SHA256 f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8
MD5 0e7fd4e7a0fd05c8208f27a3276eb042
SHA1 5a2d9c2b90969502e50b6b8229621faaabdada75
SHA512 6c7043c637d2d180bba8401491efaed150d5c663d499c8325098e69dc4d6ac0c4f5b78e8a9188deae325ef40e0dcf82fe77de10f4329f3447292fe4dd20a0908
SSDEEP 24576:XyySBHEjgQGT0EBpKwggXzlQpjpRmcdJmTff:iyUH7QGv/1ggjloxETf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
5024	x2915446.exe
2356	x1585223.exe
1668	f3613853.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2915446.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1585223.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x1585223.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	245245254202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	245245254202.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2915446.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 5024	3896	245245254202.exe	83
PID 3896 wrote to memory of 5024	3896	245245254202.exe	83
PID 3896 wrote to memory of 5024	3896	245245254202.exe	83
PID 5024 wrote to memory of 2356	5024	x2915446.exe	84
PID 5024 wrote to memory of 2356	5024	x2915446.exe	84
PID 5024 wrote to memory of 2356	5024	x2915446.exe	84
PID 2356 wrote to memory of 1668	2356	x1585223.exe	85
PID 2356 wrote to memory of 1668	2356	x1585223.exe	85
PID 2356 wrote to memory of 1668	2356	x1585223.exe	85

C:\Users\Admin\AppData\Local\Temp\245245254202.exe
"C:\Users\Admin\AppData\Local\Temp\245245254202.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2915446.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2915446.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1585223.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1585223.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3613853.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3613853.exe
      4⤵
      Executes dropped EXE
      PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2915446.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2915446.exe
Size 751KB
SHA256 ec58d4492f338d61571a09c6c50afb5f057fa370104332044bc0fa1078d38c41
MD5 487b069af238a009ccc7b954fe867213
SHA1 8be096b86306a8b7c53a2ea716965960d235f5fd
SHA512 4d67ba667ad4283c09fa3f92f5821aea3a9547cbd3f7411cf24bceba9b400c9b2ee2eeae2c52931d7f1b28c37d186dbc23e6cfca0687720c4ef26d2cf521507d
SSDEEP 12288:KMr5y90/ah+DfMwc8+HbYSlE5gKSQ9FRj6zl+6FJgRkg/Qtvj1PXxq4xfhN1f/Ng:3yteGs0E5jLBgVQ3/QpjTZ3N1XNUYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2915446.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2915446.exe
Size 751KB
SHA256 ec58d4492f338d61571a09c6c50afb5f057fa370104332044bc0fa1078d38c41
MD5 487b069af238a009ccc7b954fe867213
SHA1 8be096b86306a8b7c53a2ea716965960d235f5fd
SHA512 4d67ba667ad4283c09fa3f92f5821aea3a9547cbd3f7411cf24bceba9b400c9b2ee2eeae2c52931d7f1b28c37d186dbc23e6cfca0687720c4ef26d2cf521507d
SSDEEP 12288:KMr5y90/ah+DfMwc8+HbYSlE5gKSQ9FRj6zl+6FJgRkg/Qtvj1PXxq4xfhN1f/Ng:3yteGs0E5jLBgVQ3/QpjTZ3N1XNUYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1585223.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1585223.exe
Size 306KB
SHA256 4dd704f40ef071cdba858c1e3f0ddd87b43a69a053cfe14b35bf22caf303899b
MD5 16dfebbacd3efc47ec09c92216bfc468
SHA1 cd5a18b507f024b7e76235ae4d77e70c8031ff22
SHA512 2eb7ff9c1e843c16c664af1cf6ec2f5b9d026d04483e2e2204343f4155f05e12564417b09c79c08f4c1798c0863dacd3207f1e50734f5d8f40b2d85df28f46df
SSDEEP 6144:K3y+bnr+Pp0yN90QEjtSuQ01E2T6gohYXcPSQ9OGAGb:hMrny90TvpaEohqKSQ9pN
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1585223.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1585223.exe
Size 306KB
SHA256 4dd704f40ef071cdba858c1e3f0ddd87b43a69a053cfe14b35bf22caf303899b
MD5 16dfebbacd3efc47ec09c92216bfc468
SHA1 cd5a18b507f024b7e76235ae4d77e70c8031ff22
SHA512 2eb7ff9c1e843c16c664af1cf6ec2f5b9d026d04483e2e2204343f4155f05e12564417b09c79c08f4c1798c0863dacd3207f1e50734f5d8f40b2d85df28f46df
SSDEEP 6144:K3y+bnr+Pp0yN90QEjtSuQ01E2T6gohYXcPSQ9OGAGb:hMrny90TvpaEohqKSQ9pN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3613853.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3613853.exe
Size 145KB
SHA256 fb9e7b200be90b31890a8243ac14ab49b58352d371134d233537f6660c4ddc60
MD5 e186cb6ae4dd15a7a09f0007e39cd5e6
SHA1 dd9948fd5f53ebe58c2e38b53bf4af8a63fc7f3c
SHA512 836b8e8ac25c19863cfd667bbdec3352800c1a8bf7b7e85b816f036f9c498a2bc4b0b3983fb17235dfc5a5dcce87e9cdc555f81e1b2d28c44d72517feefaabd3
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3613853.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3613853.exe
Size 145KB
SHA256 fb9e7b200be90b31890a8243ac14ab49b58352d371134d233537f6660c4ddc60
MD5 e186cb6ae4dd15a7a09f0007e39cd5e6
SHA1 dd9948fd5f53ebe58c2e38b53bf4af8a63fc7f3c
SHA512 836b8e8ac25c19863cfd667bbdec3352800c1a8bf7b7e85b816f036f9c498a2bc4b0b3983fb17235dfc5a5dcce87e9cdc555f81e1b2d28c44d72517feefaabd3
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1668-154-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/1668-155-0x0000000005890000-0x0000000005EA8000-memory.dmp

Download

memory/1668-156-0x0000000005410000-0x000000000551A000-memory.dmp

Download

memory/1668-157-0x0000000005340000-0x0000000005352000-memory.dmp

Download

memory/1668-158-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/1668-159-0x00000000053D0000-0x000000000540C000-memory.dmp

Download

memory/1668-160-0x0000000005380000-0x0000000005390000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads