redline | 342ce456558531a366c14b73e695f088bd58a4142e2b482af0322d8fef100e45

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
423781.exe
Size 1.0MB
Sample230522-mtf86aae6z
SHA256 342ce456558531a366c14b73e695f088bd58a4142e2b482af0322d8fef100e45
MD5 5c0024b9be2b6385bd18c1a27b90a70b
SHA1 77ee8396fd817142254caa92f20279f61c7dd41e
SHA512 216fb3c4ed05d364df591ef011d7fc2453955236342620adfa0bb83b39596bfed7082f4bd80080ff72e953e9ba560b17b241e2c6e8b6ef6ed4f54ba55e1cf01e
SSDEEP 24576:ZyTRycKKn4+PSAafsbD0iMQG5R0COzHwfRMTeGKt:MtYK0RsciW0zzHwJ8K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
932	x4948562.exe
4736	x7029134.exe
1700	f3422219.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	423781.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4948562.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4948562.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7029134.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7029134.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	423781.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 932	1492	423781.exe	86
PID 1492 wrote to memory of 932	1492	423781.exe	86
PID 1492 wrote to memory of 932	1492	423781.exe	86
PID 932 wrote to memory of 4736	932	x4948562.exe	87
PID 932 wrote to memory of 4736	932	x4948562.exe	87
PID 932 wrote to memory of 4736	932	x4948562.exe	87
PID 4736 wrote to memory of 1700	4736	x7029134.exe	88
PID 4736 wrote to memory of 1700	4736	x7029134.exe	88
PID 4736 wrote to memory of 1700	4736	x7029134.exe	88

C:\Users\Admin\AppData\Local\Temp\423781.exe
"C:\Users\Admin\AppData\Local\Temp\423781.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4948562.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4948562.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7029134.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7029134.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3422219.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3422219.exe
      4⤵
      Executes dropped EXE
      PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4948562.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4948562.exe
Size 751KB
SHA256 7eea49ec543815dc5b06b02622d0ab311f3f0b8bc612a12ccd7b35e456e99471
MD5 56da9b128736046edc85b44a7ec5e131
SHA1 2960bd09d900fb71f983f7fa8fe0d5f462aae182
SHA512 d567049851da4f7f7fdfc92bbc8ca68cfeb0b73e803c7abc80150247ab41fef34b3ead92368a628b4fe696cdb5ad411c7cf0855f93045c4bded8f63099ca24cf
SSDEEP 12288:YMrWy90PDzSuKnavpGjZ9AAfD4+G20eB2uk4ZQGDUpvRLTjbrCxSvJDWL:eyez3KnavAHAAfs+n0SNQGAR3rEL
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4948562.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4948562.exe
Size 751KB
SHA256 7eea49ec543815dc5b06b02622d0ab311f3f0b8bc612a12ccd7b35e456e99471
MD5 56da9b128736046edc85b44a7ec5e131
SHA1 2960bd09d900fb71f983f7fa8fe0d5f462aae182
SHA512 d567049851da4f7f7fdfc92bbc8ca68cfeb0b73e803c7abc80150247ab41fef34b3ead92368a628b4fe696cdb5ad411c7cf0855f93045c4bded8f63099ca24cf
SSDEEP 12288:YMrWy90PDzSuKnavpGjZ9AAfD4+G20eB2uk4ZQGDUpvRLTjbrCxSvJDWL:eyez3KnavAHAAfs+n0SNQGAR3rEL
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7029134.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7029134.exe
Size 306KB
SHA256 05edceab869bb99d788f8d9d2b478439dfa43235ff5abdf51d39fbdb313c4e5f
MD5 2d77e8f1dda8b066e3c82f9a47f9de47
SHA1 802db56bbb56a87ed84d6b7860daee287820bf1d
SHA512 7ca178212614f30cced497344ee56f27b8ca427fd9e7c21241489c0dc12179d49d9c84a52337dc71622f7fd3484b03ed675a5a6e7fe1bc1acc69ba1628084673
SSDEEP 6144:K6y+bnr+Mp0yN90QEmtSuQ01IkKEqTWTZQAeRHD4Jg:aMrwy90qvpG3fNAeJD4Jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7029134.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7029134.exe
Size 306KB
SHA256 05edceab869bb99d788f8d9d2b478439dfa43235ff5abdf51d39fbdb313c4e5f
MD5 2d77e8f1dda8b066e3c82f9a47f9de47
SHA1 802db56bbb56a87ed84d6b7860daee287820bf1d
SHA512 7ca178212614f30cced497344ee56f27b8ca427fd9e7c21241489c0dc12179d49d9c84a52337dc71622f7fd3484b03ed675a5a6e7fe1bc1acc69ba1628084673
SSDEEP 6144:K6y+bnr+Mp0yN90QEmtSuQ01IkKEqTWTZQAeRHD4Jg:aMrwy90qvpG3fNAeJD4Jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3422219.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3422219.exe
Size 146KB
SHA256 00a6694186e08a39a5b368d2cb5c6f8937b2b58866e8e22b1adb93c220a36dcd
MD5 b0b3c411a13ff236abeb3172d44aa31e
SHA1 e71c77db5ae1e32dfc553d1decdfde1130f367d0
SHA512 5e32c0a91036b28773ad027ebda5c98814539e7dd2c8695bab014051e08f86c8548356ca5a47fe06471ac619c2d4a314e9614ea2672c2f065b12fda35304a07c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3422219.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3422219.exe
Size 146KB
SHA256 00a6694186e08a39a5b368d2cb5c6f8937b2b58866e8e22b1adb93c220a36dcd
MD5 b0b3c411a13ff236abeb3172d44aa31e
SHA1 e71c77db5ae1e32dfc553d1decdfde1130f367d0
SHA512 5e32c0a91036b28773ad027ebda5c98814539e7dd2c8695bab014051e08f86c8548356ca5a47fe06471ac619c2d4a314e9614ea2672c2f065b12fda35304a07c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1700-154-0x0000000000740000-0x000000000076A000-memory.dmp

Download

memory/1700-155-0x0000000005670000-0x0000000005C88000-memory.dmp

Download

memory/1700-156-0x00000000051E0000-0x00000000052EA000-memory.dmp

Download

memory/1700-157-0x0000000005110000-0x0000000005122000-memory.dmp

Download

memory/1700-158-0x0000000005170000-0x00000000051AC000-memory.dmp

Download

memory/1700-159-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/1700-160-0x0000000005480000-0x0000000005490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads