redline | 776bfce6918667da75123b325de7fd42a0936e1bb28fd528dfdee97cf880ca48

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
config255.exe
Size 1.0MB
Sample230522-mvrfhsaf4x
SHA256 776bfce6918667da75123b325de7fd42a0936e1bb28fd528dfdee97cf880ca48
MD5 6959f784efc8cf1eea70431e45e9ce3b
SHA1 f3e663b867d1620b83f2c41e5ef4740e5a5518f1
SHA512 41e7b18ffe93b014adf983e80f0240e1aae77faf19d0557e3d41a94be91c9ecf7304bc6bb1e9b04c9f49dc46e48ceb3147bdb73404a6c1da716bf0302720a801
SSDEEP 24576:OylYWBWjbF8e7RQpOWicRlEVGkyON8Se+lXKID//bq2dWMfqVSTKtjj7:diNFdQaweV1yg8rI7/N8MfGSKjj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1000	x7449665.exe
4312	x2509738.exe
4012	f7580641.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	config255.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	config255.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7449665.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7449665.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2509738.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x2509738.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1000	2232	config255.exe	84
PID 2232 wrote to memory of 1000	2232	config255.exe	84
PID 2232 wrote to memory of 1000	2232	config255.exe	84
PID 1000 wrote to memory of 4312	1000	x7449665.exe	85
PID 1000 wrote to memory of 4312	1000	x7449665.exe	85
PID 1000 wrote to memory of 4312	1000	x7449665.exe	85
PID 4312 wrote to memory of 4012	4312	x2509738.exe	86
PID 4312 wrote to memory of 4012	4312	x2509738.exe	86
PID 4312 wrote to memory of 4012	4312	x2509738.exe	86

C:\Users\Admin\AppData\Local\Temp\config255.exe
"C:\Users\Admin\AppData\Local\Temp\config255.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7449665.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7449665.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2509738.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2509738.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7580641.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7580641.exe
      4⤵
      Executes dropped EXE
      PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x7449665.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7449665.exe
Size 751KB
SHA256 d864fcb3aa295a78edf27d14d8e992e4ca00c5e14438de128818610f6ba96ae1
MD5 2d85b8519ae1375984603afad9f8e046
SHA1 41bb2f3a375b6590ec58e30f9a61b2ab80b1c6f9
SHA512 0df1f13e10501a2083f499ad19075be21c3750c564bfcfa849bb69a16546228bbf63d093b4f712a6eab4ed30a7703beb02b3666f8b3909ff1dee3fa81c53c21e
SSDEEP 12288:BMr8y90hjOLMonZbqczneYP1wtQPi3AKJUb5R6yteVboVoBShkT/mPH8u6yxsIso:RyzDZbFzeY6QPcA4qR9EVHkAOP8uOIso
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7449665.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7449665.exe
Size 751KB
SHA256 d864fcb3aa295a78edf27d14d8e992e4ca00c5e14438de128818610f6ba96ae1
MD5 2d85b8519ae1375984603afad9f8e046
SHA1 41bb2f3a375b6590ec58e30f9a61b2ab80b1c6f9
SHA512 0df1f13e10501a2083f499ad19075be21c3750c564bfcfa849bb69a16546228bbf63d093b4f712a6eab4ed30a7703beb02b3666f8b3909ff1dee3fa81c53c21e
SSDEEP 12288:BMr8y90hjOLMonZbqczneYP1wtQPi3AKJUb5R6yteVboVoBShkT/mPH8u6yxsIso:RyzDZbFzeY6QPcA4qR9EVHkAOP8uOIso
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2509738.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2509738.exe
Size 306KB
SHA256 9b9308b7ff58529078e5c9fc532446d1009cbcb5a09deb5e03a454dc6b7603a8
MD5 5b103acf17d898cee75b9cd5336a8d74
SHA1 ba271dcba1615e73bc468794afbcaaa0f50e091b
SHA512 61c80c93de2dada9890601ac5d72be9313356426b12f41f1513fb13b52b40bce119952acfca9620407b869be4eea961811799631c21e904fbfbf7ecbec23132f
SSDEEP 6144:Koy+bnr+bp0yN90QEctSuQ01Drjhx8hmHbvY38Vgres:4MrTy90EvpxrTQkY33
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2509738.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2509738.exe
Size 306KB
SHA256 9b9308b7ff58529078e5c9fc532446d1009cbcb5a09deb5e03a454dc6b7603a8
MD5 5b103acf17d898cee75b9cd5336a8d74
SHA1 ba271dcba1615e73bc468794afbcaaa0f50e091b
SHA512 61c80c93de2dada9890601ac5d72be9313356426b12f41f1513fb13b52b40bce119952acfca9620407b869be4eea961811799631c21e904fbfbf7ecbec23132f
SSDEEP 6144:Koy+bnr+bp0yN90QEctSuQ01Drjhx8hmHbvY38Vgres:4MrTy90EvpxrTQkY33
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7580641.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7580641.exe
Size 145KB
SHA256 6fe5f9ff0db0a045f61debb71fb24ba94ee66e01ed5df21a6b1b18fc4a26c5b3
MD5 3f4d2bdf06aced11463bf0dc3a730e61
SHA1 ae3b17ac4689774bbffc1eb4840a0cf39501abb9
SHA512 b1d7ee7c4da08298157f022edd0e57432340803825d7efac2fdc45a54c7a1d9133b256b1b86f27d49cc11331be052083199f6443ccc1c3ad5c9105fd7301e62e
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7580641.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7580641.exe
Size 145KB
SHA256 6fe5f9ff0db0a045f61debb71fb24ba94ee66e01ed5df21a6b1b18fc4a26c5b3
MD5 3f4d2bdf06aced11463bf0dc3a730e61
SHA1 ae3b17ac4689774bbffc1eb4840a0cf39501abb9
SHA512 b1d7ee7c4da08298157f022edd0e57432340803825d7efac2fdc45a54c7a1d9133b256b1b86f27d49cc11331be052083199f6443ccc1c3ad5c9105fd7301e62e
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4012-154-0x0000000000DF0000-0x0000000000E1A000-memory.dmp

Download

memory/4012-155-0x0000000005D10000-0x0000000006328000-memory.dmp

Download

memory/4012-156-0x0000000005890000-0x000000000599A000-memory.dmp

Download

memory/4012-157-0x00000000057C0000-0x00000000057D2000-memory.dmp

Download

memory/4012-158-0x0000000005820000-0x000000000585C000-memory.dmp

Download

memory/4012-159-0x0000000005B70000-0x0000000005B80000-memory.dmp

Download

memory/4012-160-0x0000000005B70000-0x0000000005B80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads