redline | 8b9a6aa3c2148dbbf7ba5004529f76808650b31dee24969e8c6a4b2b08fad37b

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42345333.exe
Size 1.0MB
Sample230522-mtf86aae6x
SHA256 8b9a6aa3c2148dbbf7ba5004529f76808650b31dee24969e8c6a4b2b08fad37b
MD5 0118220035a974f3d732cc5417141491
SHA1 37f91666248fbebbf08a9c076a1f9c7df4bef23f
SHA512 95bb52cdc64a1e900d41260ed870c14541caa3ba1a8b491db22604a973f7b8298cda751ec685a9710ae1f811a5921ea45d21a2f7ad71468a566f05a6f572d57b
SSDEEP 24576:lykJmUsdOKwmUUwB7T0e+qIXgW32O5q/EeC55:AksUsdOmUUwFT0e0Qs2mq/8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1348	x4929000.exe
4016	x0671063.exe
1872	f2421118.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	42345333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	42345333.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4929000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4929000.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x0671063.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x0671063.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1348	1636	42345333.exe	83
PID 1636 wrote to memory of 1348	1636	42345333.exe	83
PID 1636 wrote to memory of 1348	1636	42345333.exe	83
PID 1348 wrote to memory of 4016	1348	x4929000.exe	84
PID 1348 wrote to memory of 4016	1348	x4929000.exe	84
PID 1348 wrote to memory of 4016	1348	x4929000.exe	84
PID 4016 wrote to memory of 1872	4016	x0671063.exe	85
PID 4016 wrote to memory of 1872	4016	x0671063.exe	85
PID 4016 wrote to memory of 1872	4016	x0671063.exe	85

C:\Users\Admin\AppData\Local\Temp\42345333.exe
"C:\Users\Admin\AppData\Local\Temp\42345333.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4929000.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4929000.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0671063.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0671063.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2421118.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2421118.exe
      4⤵
      Executes dropped EXE
      PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4929000.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4929000.exe
Size 750KB
SHA256 9fed54197a802777ae5df3ee0f828539534d0f5e6b5a14d8dc0088a73ab453e0
MD5 d5a593bda6e68d6e65fd14f9f5c3f339
SHA1 2bd5f303563a8f243d4ee81015cd15b7827d3c71
SHA512 3e57c4a4105d5d8bbe0796af55f8222f651187477de3fa47c8b2e033f304596898d21e4ed9f732bcb32b070e76988a0514a46ab353fbaa56599ff10cb81280ca
SSDEEP 12288:gMr4y90PAXcOsREWTWdrCrSgU/Cp6DCam1UdRSvkC1ELXoppXGT0dwe8tllK4W1L:IybXcOMyd0AwmbUrmjTze8/z6gW32Xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4929000.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4929000.exe
Size 750KB
SHA256 9fed54197a802777ae5df3ee0f828539534d0f5e6b5a14d8dc0088a73ab453e0
MD5 d5a593bda6e68d6e65fd14f9f5c3f339
SHA1 2bd5f303563a8f243d4ee81015cd15b7827d3c71
SHA512 3e57c4a4105d5d8bbe0796af55f8222f651187477de3fa47c8b2e033f304596898d21e4ed9f732bcb32b070e76988a0514a46ab353fbaa56599ff10cb81280ca
SSDEEP 12288:gMr4y90PAXcOsREWTWdrCrSgU/Cp6DCam1UdRSvkC1ELXoppXGT0dwe8tllK4W1L:IybXcOMyd0AwmbUrmjTze8/z6gW32Xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0671063.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0671063.exe
Size 306KB
SHA256 0a5e8dec853992fa6f70e95917c22b9b851790f904bbdd9910b00235384568c1
MD5 d31b90eae5ae9d4c04b843cdda951655
SHA1 1225afbeeac70630754ff89c15b9ad0025b2a9cf
SHA512 575b17ed677f7fe18c967cf22d67a952cd3c307b18190af8e7e5a24d6500f6ddd71d5529ce4f654093c290e15b4944dec57b00073a58e521077e9e45618671e8
SSDEEP 6144:Kpy+bnr+Op0yN90QEztSuQ01aFrPD3YAlQam1hgWTh//ZSdmw+VN8:XMrWy90/vpYFrbaam1eURSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0671063.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0671063.exe
Size 306KB
SHA256 0a5e8dec853992fa6f70e95917c22b9b851790f904bbdd9910b00235384568c1
MD5 d31b90eae5ae9d4c04b843cdda951655
SHA1 1225afbeeac70630754ff89c15b9ad0025b2a9cf
SHA512 575b17ed677f7fe18c967cf22d67a952cd3c307b18190af8e7e5a24d6500f6ddd71d5529ce4f654093c290e15b4944dec57b00073a58e521077e9e45618671e8
SSDEEP 6144:Kpy+bnr+Op0yN90QEztSuQ01aFrPD3YAlQam1hgWTh//ZSdmw+VN8:XMrWy90/vpYFrbaam1eURSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2421118.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2421118.exe
Size 145KB
SHA256 db717c7dd95bbcb67bdb2c2eccbecfed38da18943cccf0d10f7663ba8b8af531
MD5 7eec1fd0dfe76deb4bbdb014cca46baa
SHA1 bee78949c5764913838b843218bf53d75e4f5173
SHA512 4f0a668708afbd245e92f31f0908a92e07b451297bd1a43a6ef438bd8e8859e4175fe1cbd937f894ce818b45c8bf850166ca3e929088765f6e443a7e91c70021
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2421118.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2421118.exe
Size 145KB
SHA256 db717c7dd95bbcb67bdb2c2eccbecfed38da18943cccf0d10f7663ba8b8af531
MD5 7eec1fd0dfe76deb4bbdb014cca46baa
SHA1 bee78949c5764913838b843218bf53d75e4f5173
SHA512 4f0a668708afbd245e92f31f0908a92e07b451297bd1a43a6ef438bd8e8859e4175fe1cbd937f894ce818b45c8bf850166ca3e929088765f6e443a7e91c70021
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1872-154-0x0000000000130000-0x000000000015A000-memory.dmp

Download

memory/1872-155-0x0000000005060000-0x0000000005678000-memory.dmp

Download

memory/1872-156-0x0000000004BD0000-0x0000000004CDA000-memory.dmp

Download

memory/1872-157-0x0000000004B00000-0x0000000004B12000-memory.dmp

Download

memory/1872-158-0x0000000004CE0000-0x0000000004D1C000-memory.dmp

Download

memory/1872-159-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/1872-160-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads