redline | a56a7c5b8208e8b37d6143b4122ffb18e052afda33b7c04e1cd2f45e90d43fe5

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35677418.exe
Size 1.0MB
Sample230522-mtfydsae6w
SHA256 a56a7c5b8208e8b37d6143b4122ffb18e052afda33b7c04e1cd2f45e90d43fe5
MD5 38ddaf5d90615a3cf386d157cfc064d1
SHA1 4ccf2ed1d6fed75eb8e34d9cbf22d41d0a06d3f1
SHA512 2e87c4702504772261d1a901a2f99b1e25c68b8a152c30fb354345bc6c0d71602e196098a8e2f394a347af2eb373112392872db22e1c2c6cd53e5da1f6c84610
SSDEEP 24576:Cycjh2Hl7V6KdpBTRp7ObMA3zSdfCUbawa7Lkn79Dyz4oOApasiCdjSg:pcAl7IKdSAA3JQa1kn7ZBAE3Cdj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3976	x5813101.exe
1960	x9919303.exe
3860	f5643073.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	35677418.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	35677418.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5813101.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5813101.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x9919303.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x9919303.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3976	3372	35677418.exe	86
PID 3372 wrote to memory of 3976	3372	35677418.exe	86
PID 3372 wrote to memory of 3976	3372	35677418.exe	86
PID 3976 wrote to memory of 1960	3976	x5813101.exe	87
PID 3976 wrote to memory of 1960	3976	x5813101.exe	87
PID 3976 wrote to memory of 1960	3976	x5813101.exe	87
PID 1960 wrote to memory of 3860	1960	x9919303.exe	88
PID 1960 wrote to memory of 3860	1960	x9919303.exe	88
PID 1960 wrote to memory of 3860	1960	x9919303.exe	88

C:\Users\Admin\AppData\Local\Temp\35677418.exe
"C:\Users\Admin\AppData\Local\Temp\35677418.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5813101.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5813101.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9919303.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9919303.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5643073.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5643073.exe
      4⤵
      Executes dropped EXE
      PID:3860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5813101.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5813101.exe
Size 750KB
SHA256 64c5b0a946f6e7f5b6ea0d99bd1f50d8f3e758bb8a45a3abd70c29b4a585273b
MD5 6bfd77345dbc56a37ac300977da4b957
SHA1 64da6ea2cd23b45ae71b08b104a00cc4602af210
SHA512 9eb736b5e828dfb98c751fcde4bf622cb91f99d1094234da9565e916d9e6c4765741720633dfcbe633c510aaeed60c8d1a8284464427aa107ec07bdbc093690c
SSDEEP 12288:iMrey90S5oNEu0popucG376y7l+p/17RdsuvNrFk+UOAe5y9aEOVkiSyzqo0Na9j:AyF5yYpo0R376y7Atz3dFTUBam+Syzqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5813101.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5813101.exe
Size 750KB
SHA256 64c5b0a946f6e7f5b6ea0d99bd1f50d8f3e758bb8a45a3abd70c29b4a585273b
MD5 6bfd77345dbc56a37ac300977da4b957
SHA1 64da6ea2cd23b45ae71b08b104a00cc4602af210
SHA512 9eb736b5e828dfb98c751fcde4bf622cb91f99d1094234da9565e916d9e6c4765741720633dfcbe633c510aaeed60c8d1a8284464427aa107ec07bdbc093690c
SSDEEP 12288:iMrey90S5oNEu0popucG376y7l+p/17RdsuvNrFk+UOAe5y9aEOVkiSyzqo0Na9j:AyF5yYpo0R376y7Atz3dFTUBam+Syzqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

x9919303.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9919303.exe
Size 306KB
SHA256 cf870f9d3adb5d721f35acca48e8a12a23ded618665ba0a51ef2c19671f8c432
MD5 86dfd4f467c44a39421e16f9486c424e
SHA1 9613997d1a84e391948e9c962f59a263b96edaae
SHA512 aab4b2f902aeaa4fe77096fc6181ad5c58434eaf74647f6acbbc4f7a651cff9d202d3ab50aa59b5ed44329eb00f30d904c04380ba2ca3b4bf708fd28cc62de70
SSDEEP 6144:Kny+bnr+lp0yN90QEVtSuQ018qVsGNAu76uqcMHHk:JMr1y90pvpuVGH76qn
MD5 SHA1 SHA512 SSDEEP

Submit Download

x9919303.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9919303.exe
Size 306KB
SHA256 cf870f9d3adb5d721f35acca48e8a12a23ded618665ba0a51ef2c19671f8c432
MD5 86dfd4f467c44a39421e16f9486c424e
SHA1 9613997d1a84e391948e9c962f59a263b96edaae
SHA512 aab4b2f902aeaa4fe77096fc6181ad5c58434eaf74647f6acbbc4f7a651cff9d202d3ab50aa59b5ed44329eb00f30d904c04380ba2ca3b4bf708fd28cc62de70
SSDEEP 6144:Kny+bnr+lp0yN90QEVtSuQ018qVsGNAu76uqcMHHk:JMr1y90pvpuVGH76qn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5643073.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5643073.exe
Size 146KB
SHA256 1e56c54c19d6fafd5f55c54833d04100ed0e0fe7758b90f37866411057de5dc9
MD5 de1bb1a2133908488b9a38feb61bf29d
SHA1 012936fdd873038d13fdc904afa9326c25103a00
SHA512 1f9d0415f17be9eebe870a69accd22491f8721c2f031f91412029589be885b2bd6085d8786942d8470fb6cb31faea7c2a5774c2a480947bba2e712520bca329c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5643073.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5643073.exe
Size 146KB
SHA256 1e56c54c19d6fafd5f55c54833d04100ed0e0fe7758b90f37866411057de5dc9
MD5 de1bb1a2133908488b9a38feb61bf29d
SHA1 012936fdd873038d13fdc904afa9326c25103a00
SHA512 1f9d0415f17be9eebe870a69accd22491f8721c2f031f91412029589be885b2bd6085d8786942d8470fb6cb31faea7c2a5774c2a480947bba2e712520bca329c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3860-154-0x0000000000FE0000-0x000000000100A000-memory.dmp

Download

memory/3860-155-0x0000000005F20000-0x0000000006538000-memory.dmp

Download

memory/3860-156-0x0000000005A80000-0x0000000005B8A000-memory.dmp

Download

memory/3860-157-0x00000000059B0000-0x00000000059C2000-memory.dmp

Download

memory/3860-158-0x0000000005A40000-0x0000000005A50000-memory.dmp

Download

memory/3860-159-0x0000000005B90000-0x0000000005BCC000-memory.dmp

Download

memory/3860-160-0x0000000005A40000-0x0000000005A50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads