redline | 3cadc437be7307a442c8a76fdf6d4fab05e3d7bca4c2becb868dc6988e9faa15

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66234358.exe
Size 1.0MB
Sample230522-mtg6fsfg72
SHA256 3cadc437be7307a442c8a76fdf6d4fab05e3d7bca4c2becb868dc6988e9faa15
MD5 148487dcd7fc125bcbc216a7d60ff952
SHA1 cc57226a091732550107cf6437cedbedebb39a33
SHA512 f95c8bbd56e7aed219830f8ad1b28ee5dfa9675fffb9afa2e67877d9965d2c31099a7c2e2ddad38aafd66a82e9978e02386f02683a19bac46ae28ebfcddfe417
SSDEEP 12288:lMr0y90FngdYE9DpjawyFnBlpFhhE9NdiUGwoCi5kLAL/RqpYFL0X60LYgBmY4p1:RyssYGGtnBl0EwoCijR30X60MXzbMq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3752	x7592314.exe
4636	x6342583.exe
1464	f6229254.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6342583.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	66234358.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	66234358.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7592314.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7592314.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6342583.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3752	3732	66234358.exe	81
PID 3732 wrote to memory of 3752	3732	66234358.exe	81
PID 3732 wrote to memory of 3752	3732	66234358.exe	81
PID 3752 wrote to memory of 4636	3752	x7592314.exe	82
PID 3752 wrote to memory of 4636	3752	x7592314.exe	82
PID 3752 wrote to memory of 4636	3752	x7592314.exe	82
PID 4636 wrote to memory of 1464	4636	x6342583.exe	83
PID 4636 wrote to memory of 1464	4636	x6342583.exe	83
PID 4636 wrote to memory of 1464	4636	x6342583.exe	83

C:\Users\Admin\AppData\Local\Temp\66234358.exe
"C:\Users\Admin\AppData\Local\Temp\66234358.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7592314.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7592314.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6342583.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6342583.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6229254.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6229254.exe
      4⤵
      Executes dropped EXE
      PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x7592314.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7592314.exe
Size 750KB
SHA256 d2375d59aaec97b613db498075f2c028c24d2c2aeb66097c0bc221be8cf146dc
MD5 4bb45dd000341005389763046725e187
SHA1 55beb694c111e1c27bf17e9585032e12ff836167
SHA512 aa373e9fca7f3d13444a30eb23fd9358242d989d614088b67da656d9c7c30a167ad640333eac44c2d0bb88f8886733bde023de44210f7db13f438b31e2e66b15
SSDEEP 12288:6Mroy90prVDzT/E6ByDnzlbFhXc9KdIUGKoLM5dLALfRMpYFQOkeEmoy0LhgFG:+yqrVDsnz7FCKoLMSRyOv1oy0Fx
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7592314.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7592314.exe
Size 750KB
SHA256 d2375d59aaec97b613db498075f2c028c24d2c2aeb66097c0bc221be8cf146dc
MD5 4bb45dd000341005389763046725e187
SHA1 55beb694c111e1c27bf17e9585032e12ff836167
SHA512 aa373e9fca7f3d13444a30eb23fd9358242d989d614088b67da656d9c7c30a167ad640333eac44c2d0bb88f8886733bde023de44210f7db13f438b31e2e66b15
SSDEEP 12288:6Mroy90prVDzT/E6ByDnzlbFhXc9KdIUGKoLM5dLALfRMpYFQOkeEmoy0LhgFG:+yqrVDsnz7FCKoLMSRyOv1oy0Fx
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6342583.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6342583.exe
Size 306KB
SHA256 fee0a5ca52a00879cb82e6b015529af4572cd3274675726c958a256df7cee2ab
MD5 0367dfc76fc1fbac2fdbf344efb39a16
SHA1 08dde88d661c0691716c6be042da2cc7a39c33d0
SHA512 0a76324d1eb79c2f99e6daf7c351dc74861d934d0f4f53b0eb6c1a5a0f3064732f6e51d1743d9f582d59b0ac6ab27975a858578b2070c36138b31e5038cb56cc
SSDEEP 6144:Koy+bnr+Rp0yN90QEFtSuQ01+LG5//cAhi9CcWdaDJ8M1s:kMr1y90Vvp0LOTc9Kdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6342583.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6342583.exe
Size 306KB
SHA256 fee0a5ca52a00879cb82e6b015529af4572cd3274675726c958a256df7cee2ab
MD5 0367dfc76fc1fbac2fdbf344efb39a16
SHA1 08dde88d661c0691716c6be042da2cc7a39c33d0
SHA512 0a76324d1eb79c2f99e6daf7c351dc74861d934d0f4f53b0eb6c1a5a0f3064732f6e51d1743d9f582d59b0ac6ab27975a858578b2070c36138b31e5038cb56cc
SSDEEP 6144:Koy+bnr+Rp0yN90QEFtSuQ01+LG5//cAhi9CcWdaDJ8M1s:kMr1y90Vvp0LOTc9Kdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6229254.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6229254.exe
Size 146KB
SHA256 67edc074574670ae358e064f1cf36186534840ec6d8e88b15214bd74e5177e95
MD5 5db7054ff382c3d6bc670849f67f4567
SHA1 fc5a1c2238d78e4fd20be2361dc9bc1205c73760
SHA512 8a9b869a7d347f6e90181bb21873cc0a9dbeb6b0fb2be86f8886ce5df92e3abd53a6e95fbcc713c6fcb5f9a54f54a130202f26d642cc61800ecadb114c91b53d
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6229254.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6229254.exe
Size 146KB
SHA256 67edc074574670ae358e064f1cf36186534840ec6d8e88b15214bd74e5177e95
MD5 5db7054ff382c3d6bc670849f67f4567
SHA1 fc5a1c2238d78e4fd20be2361dc9bc1205c73760
SHA512 8a9b869a7d347f6e90181bb21873cc0a9dbeb6b0fb2be86f8886ce5df92e3abd53a6e95fbcc713c6fcb5f9a54f54a130202f26d642cc61800ecadb114c91b53d
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1464-154-0x0000000000080000-0x00000000000AA000-memory.dmp

Download

memory/1464-155-0x0000000004FA0000-0x00000000055B8000-memory.dmp

Download

memory/1464-156-0x0000000004B20000-0x0000000004C2A000-memory.dmp

Download

memory/1464-157-0x0000000004A60000-0x0000000004A72000-memory.dmp

Download

memory/1464-158-0x0000000004AC0000-0x0000000004AFC000-memory.dmp

Download

memory/1464-159-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/1464-160-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads