redline | bd14b2fa825264e84a56c89cb37cefba98fc2753a8422d7574be88f2eec6ea65

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42345997.exe
Size 1.0MB
Sample230522-mtf86aae6y
SHA256 bd14b2fa825264e84a56c89cb37cefba98fc2753a8422d7574be88f2eec6ea65
MD5 a5f1ea7b7a2390c021c3ea154f71797e
SHA1 43586054df5e815017da046bfae40eab6dfbb04e
SHA512 2291a9cd964db950605f275c409384868146a9f58e2c90b824f351d84874dc99efb1b14337b52a1ab2090288b5e86e03f2db9d0b0787cb74f31e411ff69bb221
SSDEEP 24576:QyYh98J0ijGWUFgh++Rr9Lje3hla4owljyWW8erfNi:XYenik+Kr9+hwrRv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1696	x4406889.exe
1432	x6847496.exe
1868	f2832791.exe

Loads dropped DLL 6 IoCs

pid	Process
1592	42345997.exe
1696	x4406889.exe
1696	x4406889.exe
1432	x6847496.exe
1432	x6847496.exe
1868	f2832791.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	42345997.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4406889.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4406889.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6847496.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6847496.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	42345997.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1592 wrote to memory of 1696	1592	42345997.exe	28
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1696 wrote to memory of 1432	1696	x4406889.exe	29
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30
PID 1432 wrote to memory of 1868	1432	x6847496.exe	30

C:\Users\Admin\AppData\Local\Temp\42345997.exe
"C:\Users\Admin\AppData\Local\Temp\42345997.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4406889.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
Size 750KB
SHA256 c7dace1d3a83e8a63dfca34ebe9e8b56e52f0a188ddd9b740c46d1b4332facb0
MD5 4f54d5516f446ce3cd16d7f3fc738f40
SHA1 4054d59c8a5eaba89724dc86b2351e96a17f1ded
SHA512 4e7b49115db644675c4ff4099286555a3ca091568a0c67510f2b80c52c5a3691130ad8cc7f7ed961180fb2dd0d5288bba3cf987d7b7a9950feea50b5addbb5e1
SSDEEP 12288:HMrXy90lnjO2m/dpdbpnhh++R6B9xGAnegUpHylodMidlGZyeimfZrAL:MyqjGNbVhh++RK9xjeJylsMidUZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4406889.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
Size 750KB
SHA256 c7dace1d3a83e8a63dfca34ebe9e8b56e52f0a188ddd9b740c46d1b4332facb0
MD5 4f54d5516f446ce3cd16d7f3fc738f40
SHA1 4054d59c8a5eaba89724dc86b2351e96a17f1ded
SHA512 4e7b49115db644675c4ff4099286555a3ca091568a0c67510f2b80c52c5a3691130ad8cc7f7ed961180fb2dd0d5288bba3cf987d7b7a9950feea50b5addbb5e1
SSDEEP 12288:HMrXy90lnjO2m/dpdbpnhh++R6B9xGAnegUpHylodMidlGZyeimfZrAL:MyqjGNbVhh++RK9xjeJylsMidUZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6847496.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
Size 306KB
SHA256 cb8c3c82edaef8a2b82e3a58acb3a77148ba28c34918ab6caee03b0047177072
MD5 2922ee8574da64455ab76210edde655d
SHA1 ec5b1322edb48f2502c15aab364d58fa66c2b4c4
SHA512 68a1ee77b7e0b57e7cb84e3bd088a715a672bfbf2b831ce746c72d6a10501e614c2df4e5b6f9bee05ceeabb1be72c80b95fd04a968f733831e6a024be011949c
SSDEEP 6144:Kny+bnr+dp0yN90QEYtSuQ01NmOh++RpmAWw1y+v+k9negBvL:BMrBy90Qvpn7h++RpB9xG2neg5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6847496.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
Size 306KB
SHA256 cb8c3c82edaef8a2b82e3a58acb3a77148ba28c34918ab6caee03b0047177072
MD5 2922ee8574da64455ab76210edde655d
SHA1 ec5b1322edb48f2502c15aab364d58fa66c2b4c4
SHA512 68a1ee77b7e0b57e7cb84e3bd088a715a672bfbf2b831ce746c72d6a10501e614c2df4e5b6f9bee05ceeabb1be72c80b95fd04a968f733831e6a024be011949c
SSDEEP 6144:Kny+bnr+dp0yN90QEYtSuQ01NmOh++RpmAWw1y+v+k9negBvL:BMrBy90Qvpn7h++RpB9xG2neg5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2832791.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
Size 146KB
SHA256 5d54ef3157c99b57d739f68e1097de24c007598db3e8a0fc0080328c71ee6fe0
MD5 a415c1e2b905adf73386814f4e5a8caa
SHA1 96dbbe8e7e17fd5dda30ad42771d96cbadd7e7d8
SHA512 6af05a64e503134c2b9346b1bedb162b283ffc4538dcb4d8060c3bdc0ac706b17d1ba544158d8b77daf91c9f1b5f38c4d3a6ddf8959720332710d461cafac477
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2832791.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
Size 146KB
SHA256 5d54ef3157c99b57d739f68e1097de24c007598db3e8a0fc0080328c71ee6fe0
MD5 a415c1e2b905adf73386814f4e5a8caa
SHA1 96dbbe8e7e17fd5dda30ad42771d96cbadd7e7d8
SHA512 6af05a64e503134c2b9346b1bedb162b283ffc4538dcb4d8060c3bdc0ac706b17d1ba544158d8b77daf91c9f1b5f38c4d3a6ddf8959720332710d461cafac477
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4406889.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
Size 750KB
SHA256 c7dace1d3a83e8a63dfca34ebe9e8b56e52f0a188ddd9b740c46d1b4332facb0
MD5 4f54d5516f446ce3cd16d7f3fc738f40
SHA1 4054d59c8a5eaba89724dc86b2351e96a17f1ded
SHA512 4e7b49115db644675c4ff4099286555a3ca091568a0c67510f2b80c52c5a3691130ad8cc7f7ed961180fb2dd0d5288bba3cf987d7b7a9950feea50b5addbb5e1
SSDEEP 12288:HMrXy90lnjO2m/dpdbpnhh++R6B9xGAnegUpHylodMidlGZyeimfZrAL:MyqjGNbVhh++RK9xjeJylsMidUZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4406889.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x4406889.exe
Size 750KB
SHA256 c7dace1d3a83e8a63dfca34ebe9e8b56e52f0a188ddd9b740c46d1b4332facb0
MD5 4f54d5516f446ce3cd16d7f3fc738f40
SHA1 4054d59c8a5eaba89724dc86b2351e96a17f1ded
SHA512 4e7b49115db644675c4ff4099286555a3ca091568a0c67510f2b80c52c5a3691130ad8cc7f7ed961180fb2dd0d5288bba3cf987d7b7a9950feea50b5addbb5e1
SSDEEP 12288:HMrXy90lnjO2m/dpdbpnhh++R6B9xGAnegUpHylodMidlGZyeimfZrAL:MyqjGNbVhh++RK9xjeJylsMidUZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6847496.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
Size 306KB
SHA256 cb8c3c82edaef8a2b82e3a58acb3a77148ba28c34918ab6caee03b0047177072
MD5 2922ee8574da64455ab76210edde655d
SHA1 ec5b1322edb48f2502c15aab364d58fa66c2b4c4
SHA512 68a1ee77b7e0b57e7cb84e3bd088a715a672bfbf2b831ce746c72d6a10501e614c2df4e5b6f9bee05ceeabb1be72c80b95fd04a968f733831e6a024be011949c
SSDEEP 6144:Kny+bnr+dp0yN90QEYtSuQ01NmOh++RpmAWw1y+v+k9negBvL:BMrBy90Qvpn7h++RpB9xG2neg5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6847496.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x6847496.exe
Size 306KB
SHA256 cb8c3c82edaef8a2b82e3a58acb3a77148ba28c34918ab6caee03b0047177072
MD5 2922ee8574da64455ab76210edde655d
SHA1 ec5b1322edb48f2502c15aab364d58fa66c2b4c4
SHA512 68a1ee77b7e0b57e7cb84e3bd088a715a672bfbf2b831ce746c72d6a10501e614c2df4e5b6f9bee05ceeabb1be72c80b95fd04a968f733831e6a024be011949c
SSDEEP 6144:Kny+bnr+dp0yN90QEYtSuQ01NmOh++RpmAWw1y+v+k9negBvL:BMrBy90Qvpn7h++RpB9xG2neg5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2832791.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
Size 146KB
SHA256 5d54ef3157c99b57d739f68e1097de24c007598db3e8a0fc0080328c71ee6fe0
MD5 a415c1e2b905adf73386814f4e5a8caa
SHA1 96dbbe8e7e17fd5dda30ad42771d96cbadd7e7d8
SHA512 6af05a64e503134c2b9346b1bedb162b283ffc4538dcb4d8060c3bdc0ac706b17d1ba544158d8b77daf91c9f1b5f38c4d3a6ddf8959720332710d461cafac477
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2832791.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f2832791.exe
Size 146KB
SHA256 5d54ef3157c99b57d739f68e1097de24c007598db3e8a0fc0080328c71ee6fe0
MD5 a415c1e2b905adf73386814f4e5a8caa
SHA1 96dbbe8e7e17fd5dda30ad42771d96cbadd7e7d8
SHA512 6af05a64e503134c2b9346b1bedb162b283ffc4538dcb4d8060c3bdc0ac706b17d1ba544158d8b77daf91c9f1b5f38c4d3a6ddf8959720332710d461cafac477
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1868-84-0x0000000000F90000-0x0000000000FBA000-memory.dmp

Download

memory/1868-85-0x0000000005160000-0x00000000051A0000-memory.dmp

Download

memory/1868-86-0x0000000005160000-0x00000000051A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads