redline | b9668618f2897dd8ae6a9b04bfd438a757b7bfa72bf6a01fea3d7370869ecf86

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
builder554.exe
Size 1.0MB
Sample230522-mt4z8aaf3t
SHA256 b9668618f2897dd8ae6a9b04bfd438a757b7bfa72bf6a01fea3d7370869ecf86
MD5 187358b96b9b58aeb82c4908be69111f
SHA1 d5a35bd9d52d26d7ea6c25575bbec317640256d6
SHA512 330fb61ef13628891d7a9e73b37d9526d30fb36b4ec8096dba54edf2632e9d8eae8c5d2a1604734cf0d06098dfdc2a7f6a1cf8a405cda2b62445dc71290d3b00
SSDEEP 24576:/y3xfGAXoGzQoJK1hMm8+D1x0KTyC9Z+Jz:KdGADPJKnMX+AKTyQ6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1380	x1777961.exe
636	x0291549.exe
468	f6198554.exe

Loads dropped DLL 6 IoCs

pid	Process
1536	builder554.exe
1380	x1777961.exe
1380	x1777961.exe
636	x0291549.exe
636	x0291549.exe
468	f6198554.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1777961.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x0291549.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x0291549.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	builder554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	builder554.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1777961.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1536 wrote to memory of 1380	1536	builder554.exe	27
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 1380 wrote to memory of 636	1380	x1777961.exe	28
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29
PID 636 wrote to memory of 468	636	x0291549.exe	29

C:\Users\Admin\AppData\Local\Temp\builder554.exe
"C:\Users\Admin\AppData\Local\Temp\builder554.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1777961.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
Size 752KB
SHA256 6ad82218f3ee67df6a58258169269ecd16269941f4763e4c3d9b89941085746e
MD5 71defa097aab9b9502fe880ddcc79cf8
SHA1 07c3e93c645b17483904e363bb527a4f1ca6a15b
SHA512 9c68b0f6cd5840779cb0e8263d7280520f7025f4c0524738795aae3d040b20f5e93fdfe99422b65cdfa81e7b3324f5e73daff33f5de3833194ba57e820ed5ed2
SSDEEP 12288:FMrAy90kZSTyWQEuTPymrVe6OxfIw/3z6VxKpM1Kg1g7Wp1aaiH9g8DG:1yPEu/5ofoVxuM1TI7nDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1777961.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
Size 752KB
SHA256 6ad82218f3ee67df6a58258169269ecd16269941f4763e4c3d9b89941085746e
MD5 71defa097aab9b9502fe880ddcc79cf8
SHA1 07c3e93c645b17483904e363bb527a4f1ca6a15b
SHA512 9c68b0f6cd5840779cb0e8263d7280520f7025f4c0524738795aae3d040b20f5e93fdfe99422b65cdfa81e7b3324f5e73daff33f5de3833194ba57e820ed5ed2
SSDEEP 12288:FMrAy90kZSTyWQEuTPymrVe6OxfIw/3z6VxKpM1Kg1g7Wp1aaiH9g8DG:1yPEu/5ofoVxuM1TI7nDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0291549.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
Size 306KB
SHA256 fd5b050b3e9451ecadb62ad76e3a2f92e60719239d789d75cc0a4218b8f2bbe6
MD5 d70321ad158e8ea4dbe04f8871d7f204
SHA1 331af3f330bbe11a30ac3df4864bc848f9283dcd
SHA512 0c83eca350e76cf29fbe4e6ee5558449020fd6b477909735172c4c6975fc0637f854bb987930b2ef9827f67f826706deeb6af28a863820774dd6c67e54943fc5
SSDEEP 6144:KMy+bnr++p0yN90QEUtSuQ01Rnw9AeQe2qbvfIR78kidgmjRVN:AMrWy904vpjBe6OvfIGkUjRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0291549.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
Size 306KB
SHA256 fd5b050b3e9451ecadb62ad76e3a2f92e60719239d789d75cc0a4218b8f2bbe6
MD5 d70321ad158e8ea4dbe04f8871d7f204
SHA1 331af3f330bbe11a30ac3df4864bc848f9283dcd
SHA512 0c83eca350e76cf29fbe4e6ee5558449020fd6b477909735172c4c6975fc0637f854bb987930b2ef9827f67f826706deeb6af28a863820774dd6c67e54943fc5
SSDEEP 6144:KMy+bnr++p0yN90QEUtSuQ01Rnw9AeQe2qbvfIR78kidgmjRVN:AMrWy904vpjBe6OvfIGkUjRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6198554.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
Size 146KB
SHA256 9229da977c1b407304d69a55f0ef4055bd6561be57e5879b7312a3f9540ef84b
MD5 7cef28ee919a5a635d8f84a0cff0cd1c
SHA1 e0b3dadc019c4fcc065c724e4afc8757e45b247e
SHA512 c53df9b34a79db6d1fca68d1580bdfbd541f7f8a4110f4194c0de9b607a9ae845b078cab53361b55e6d57311a06b59f4d77e94822020a6f2a680418c73288322
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6198554.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
Size 146KB
SHA256 9229da977c1b407304d69a55f0ef4055bd6561be57e5879b7312a3f9540ef84b
MD5 7cef28ee919a5a635d8f84a0cff0cd1c
SHA1 e0b3dadc019c4fcc065c724e4afc8757e45b247e
SHA512 c53df9b34a79db6d1fca68d1580bdfbd541f7f8a4110f4194c0de9b607a9ae845b078cab53361b55e6d57311a06b59f4d77e94822020a6f2a680418c73288322
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1777961.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
Size 752KB
SHA256 6ad82218f3ee67df6a58258169269ecd16269941f4763e4c3d9b89941085746e
MD5 71defa097aab9b9502fe880ddcc79cf8
SHA1 07c3e93c645b17483904e363bb527a4f1ca6a15b
SHA512 9c68b0f6cd5840779cb0e8263d7280520f7025f4c0524738795aae3d040b20f5e93fdfe99422b65cdfa81e7b3324f5e73daff33f5de3833194ba57e820ed5ed2
SSDEEP 12288:FMrAy90kZSTyWQEuTPymrVe6OxfIw/3z6VxKpM1Kg1g7Wp1aaiH9g8DG:1yPEu/5ofoVxuM1TI7nDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1777961.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x1777961.exe
Size 752KB
SHA256 6ad82218f3ee67df6a58258169269ecd16269941f4763e4c3d9b89941085746e
MD5 71defa097aab9b9502fe880ddcc79cf8
SHA1 07c3e93c645b17483904e363bb527a4f1ca6a15b
SHA512 9c68b0f6cd5840779cb0e8263d7280520f7025f4c0524738795aae3d040b20f5e93fdfe99422b65cdfa81e7b3324f5e73daff33f5de3833194ba57e820ed5ed2
SSDEEP 12288:FMrAy90kZSTyWQEuTPymrVe6OxfIw/3z6VxKpM1Kg1g7Wp1aaiH9g8DG:1yPEu/5ofoVxuM1TI7nDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0291549.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
Size 306KB
SHA256 fd5b050b3e9451ecadb62ad76e3a2f92e60719239d789d75cc0a4218b8f2bbe6
MD5 d70321ad158e8ea4dbe04f8871d7f204
SHA1 331af3f330bbe11a30ac3df4864bc848f9283dcd
SHA512 0c83eca350e76cf29fbe4e6ee5558449020fd6b477909735172c4c6975fc0637f854bb987930b2ef9827f67f826706deeb6af28a863820774dd6c67e54943fc5
SSDEEP 6144:KMy+bnr++p0yN90QEUtSuQ01Rnw9AeQe2qbvfIR78kidgmjRVN:AMrWy904vpjBe6OvfIGkUjRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0291549.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0291549.exe
Size 306KB
SHA256 fd5b050b3e9451ecadb62ad76e3a2f92e60719239d789d75cc0a4218b8f2bbe6
MD5 d70321ad158e8ea4dbe04f8871d7f204
SHA1 331af3f330bbe11a30ac3df4864bc848f9283dcd
SHA512 0c83eca350e76cf29fbe4e6ee5558449020fd6b477909735172c4c6975fc0637f854bb987930b2ef9827f67f826706deeb6af28a863820774dd6c67e54943fc5
SSDEEP 6144:KMy+bnr++p0yN90QEUtSuQ01Rnw9AeQe2qbvfIR78kidgmjRVN:AMrWy904vpjBe6OvfIGkUjRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6198554.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
Size 146KB
SHA256 9229da977c1b407304d69a55f0ef4055bd6561be57e5879b7312a3f9540ef84b
MD5 7cef28ee919a5a635d8f84a0cff0cd1c
SHA1 e0b3dadc019c4fcc065c724e4afc8757e45b247e
SHA512 c53df9b34a79db6d1fca68d1580bdfbd541f7f8a4110f4194c0de9b607a9ae845b078cab53361b55e6d57311a06b59f4d77e94822020a6f2a680418c73288322
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6198554.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f6198554.exe
Size 146KB
SHA256 9229da977c1b407304d69a55f0ef4055bd6561be57e5879b7312a3f9540ef84b
MD5 7cef28ee919a5a635d8f84a0cff0cd1c
SHA1 e0b3dadc019c4fcc065c724e4afc8757e45b247e
SHA512 c53df9b34a79db6d1fca68d1580bdfbd541f7f8a4110f4194c0de9b607a9ae845b078cab53361b55e6d57311a06b59f4d77e94822020a6f2a680418c73288322
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-84-0x0000000000850000-0x000000000087A000-memory.dmp

Download

memory/468-85-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Download

memory/468-86-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads