redline | ea4577b234e1938f566fd52574455e3fe0412c4dbcd1cf04058f50c3cf0b88fe

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unlock270.exe
Size 1.0MB
Sample230522-mt1b2aae9w
SHA256 ea4577b234e1938f566fd52574455e3fe0412c4dbcd1cf04058f50c3cf0b88fe
MD5 46ba80ac4b5f50f53407b2df9b794d8c
SHA1 ba63e0a2e94a84f1342fcd9d58aa7613de8aa1ec
SHA512 18cd146e243919858c4c178d597d024863ce8216bb9c12d857563318a4c1074ebc686db88dfa619af84ded75e15a5a462537dbeb6a7f579bc386f615dc841a53
SSDEEP 12288:aMrJy90jySSD0NgrRD57kA4aAuvpjY8UqbGBWIKzsEQT1vX9+6k4rOekn1zSm84Y:zyeLgrRDdhAUNGXwIKIEsf5r8/D16Eu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3820	x7239680.exe
376	x7906790.exe
4876	f7883087.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Unlock270.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Unlock270.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7239680.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7239680.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7906790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7906790.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3820	1696	Unlock270.exe	84
PID 1696 wrote to memory of 3820	1696	Unlock270.exe	84
PID 1696 wrote to memory of 3820	1696	Unlock270.exe	84
PID 3820 wrote to memory of 376	3820	x7239680.exe	85
PID 3820 wrote to memory of 376	3820	x7239680.exe	85
PID 3820 wrote to memory of 376	3820	x7239680.exe	85
PID 376 wrote to memory of 4876	376	x7906790.exe	86
PID 376 wrote to memory of 4876	376	x7906790.exe	86
PID 376 wrote to memory of 4876	376	x7906790.exe	86

C:\Users\Admin\AppData\Local\Temp\Unlock270.exe
"C:\Users\Admin\AppData\Local\Temp\Unlock270.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7239680.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7239680.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7906790.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7906790.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7883087.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7883087.exe
      4⤵
      Executes dropped EXE
      PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x7239680.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7239680.exe
Size 750KB
SHA256 8489c7836eb34e8096bf9bbe2f2b9149eb3bdb68e963239a6f4091e0d3a83d4f
MD5 96eee89424153b079ee63e3443a96697
SHA1 1fdfe9cc11671160316358526d4d542b2337e17f
SHA512 f4a3da56933a0f58b0f369fa6c3605c0f99454c79580d6585abe3cb12eb727e7add16e3f3475987305f5cebf6ae3a6a129a0184f04d47580f2cc7e3de02bbcca
SSDEEP 12288:yMrYy90NaVdz757sA4aLNvGjRdUlbGEzHvzs9Z5xpi4r8/kE:WyGaVNdJLxEcUWHvI9vTxr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7239680.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7239680.exe
Size 750KB
SHA256 8489c7836eb34e8096bf9bbe2f2b9149eb3bdb68e963239a6f4091e0d3a83d4f
MD5 96eee89424153b079ee63e3443a96697
SHA1 1fdfe9cc11671160316358526d4d542b2337e17f
SHA512 f4a3da56933a0f58b0f369fa6c3605c0f99454c79580d6585abe3cb12eb727e7add16e3f3475987305f5cebf6ae3a6a129a0184f04d47580f2cc7e3de02bbcca
SSDEEP 12288:yMrYy90NaVdz757sA4aLNvGjRdUlbGEzHvzs9Z5xpi4r8/kE:WyGaVNdJLxEcUWHvI9vTxr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7906790.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7906790.exe
Size 305KB
SHA256 c508100af0704fc8ad26ba5e77a076f94d6339f68b2c9433f49aa1af80194e59
MD5 d88e4cb85046d82622e5146177f799ea
SHA1 14dccd8091a84cc74aa3173172b8bba3f50638c1
SHA512 98ee9f961373d55a4ad8fb72e3118973bfa26d1d763c9f26ccc1eaf0f9f911cb7cd568eb71dfa92480a8190748b5b46fad0a355c7581961575fa7a5ab1a2f304
SSDEEP 6144:Kty+bnr+gp0yN90QEYtSuQ01231hDYdjAMnI26Qn6h:jMrIy90wvpk3v2jRxFo
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7906790.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7906790.exe
Size 305KB
SHA256 c508100af0704fc8ad26ba5e77a076f94d6339f68b2c9433f49aa1af80194e59
MD5 d88e4cb85046d82622e5146177f799ea
SHA1 14dccd8091a84cc74aa3173172b8bba3f50638c1
SHA512 98ee9f961373d55a4ad8fb72e3118973bfa26d1d763c9f26ccc1eaf0f9f911cb7cd568eb71dfa92480a8190748b5b46fad0a355c7581961575fa7a5ab1a2f304
SSDEEP 6144:Kty+bnr+gp0yN90QEYtSuQ01231hDYdjAMnI26Qn6h:jMrIy90wvpk3v2jRxFo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7883087.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7883087.exe
Size 145KB
SHA256 c75cb42492a6237c9c3821f018c51d06a1b290c1854c40287c192e66f86dbe75
MD5 99dc10c430b38d7bb670c9e5650314b1
SHA1 668ef3add809499d2c048141717a2f7657f1630a
SHA512 ed28771d10789c43555c7479da930c826fe2c926704a9171caeb18327c35c9e78b0fc089d94919aba5c00b4b6c21cc6ee8129807258cc213d393296192cca8aa
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7883087.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7883087.exe
Size 145KB
SHA256 c75cb42492a6237c9c3821f018c51d06a1b290c1854c40287c192e66f86dbe75
MD5 99dc10c430b38d7bb670c9e5650314b1
SHA1 668ef3add809499d2c048141717a2f7657f1630a
SHA512 ed28771d10789c43555c7479da930c826fe2c926704a9171caeb18327c35c9e78b0fc089d94919aba5c00b4b6c21cc6ee8129807258cc213d393296192cca8aa
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4876-154-0x0000000000050000-0x000000000007A000-memory.dmp

Download

memory/4876-155-0x0000000004FD0000-0x00000000055E8000-memory.dmp

Download

memory/4876-156-0x0000000004AF0000-0x0000000004BFA000-memory.dmp

Download

memory/4876-157-0x0000000004A20000-0x0000000004A32000-memory.dmp

Download

memory/4876-158-0x0000000004A80000-0x0000000004ABC000-memory.dmp

Download

memory/4876-159-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Download

memory/4876-160-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads