redline | 2f46d16e19fdc17268964f194e728ad94c8505a4c27504a4d2b8eff5c8d38967

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
controls541.exe
Size 1.0MB
Sample230522-mvsctafh34
SHA256 2f46d16e19fdc17268964f194e728ad94c8505a4c27504a4d2b8eff5c8d38967
MD5 78a94154e27394efafd1004b799cd32d
SHA1 6bd8660fc6e96384abcbef122709b009e165991f
SHA512 930f13acc1dc70a037409fc7af78517b181942e53ca6b7b647737b5fd54a4bc71dd090916bcfe64b0ee09a0ac675e9f29d7c87d43da074323152444fda2d613b
SSDEEP 24576:ayDyxFQ+x3cJ4bGexUks2yvl1EpgnWNna8XbsStO7oj:hDynQLeC2yvl1ECYakbsSt4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3440	x0471959.exe
800	x2328559.exe
1172	f7043037.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x0471959.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x0471959.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2328559.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x2328559.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	controls541.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	controls541.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3440	3736	controls541.exe	84
PID 3736 wrote to memory of 3440	3736	controls541.exe	84
PID 3736 wrote to memory of 3440	3736	controls541.exe	84
PID 3440 wrote to memory of 800	3440	x0471959.exe	85
PID 3440 wrote to memory of 800	3440	x0471959.exe	85
PID 3440 wrote to memory of 800	3440	x0471959.exe	85
PID 800 wrote to memory of 1172	800	x2328559.exe	86
PID 800 wrote to memory of 1172	800	x2328559.exe	86
PID 800 wrote to memory of 1172	800	x2328559.exe	86

C:\Users\Admin\AppData\Local\Temp\controls541.exe
"C:\Users\Admin\AppData\Local\Temp\controls541.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0471959.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0471959.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2328559.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2328559.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7043037.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7043037.exe
      4⤵
      Executes dropped EXE
      PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x0471959.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0471959.exe
Size 750KB
SHA256 a33b043a8fe44a6196f3837853e55e7ef0811d8fb8d1700e0a0704f2c7ab104b
MD5 739ae60eb89bf760904431ad634df348
SHA1 bb252199c49591ea3fc376ae969d238618e00feb
SHA512 eba79e2009a0354e763df8aa956c65bfcb9918b9495e18858e7dd37d8a98cae380063dea52ddbf0ba41c1ec3499193db7b4d5abc1e8dced29ed9e5cc13d689bb
SSDEEP 12288:YMrZy90FvmdP+zc0f4bwhpopPNqcrnb2U5rvLGw3vLjmYoWtf6+kgPuoWNUaxPD:ByHd+c44bcarnvRaAvgy6+kgnWNUax7
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0471959.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0471959.exe
Size 750KB
SHA256 a33b043a8fe44a6196f3837853e55e7ef0811d8fb8d1700e0a0704f2c7ab104b
MD5 739ae60eb89bf760904431ad634df348
SHA1 bb252199c49591ea3fc376ae969d238618e00feb
SHA512 eba79e2009a0354e763df8aa956c65bfcb9918b9495e18858e7dd37d8a98cae380063dea52ddbf0ba41c1ec3499193db7b4d5abc1e8dced29ed9e5cc13d689bb
SSDEEP 12288:YMrZy90FvmdP+zc0f4bwhpopPNqcrnb2U5rvLGw3vLjmYoWtf6+kgPuoWNUaxPD:ByHd+c44bcarnvRaAvgy6+kgnWNUax7
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2328559.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2328559.exe
Size 306KB
SHA256 0c42a24d5ce1064b90636bba362af524f2b56e9731a3383844050321c13fbec0
MD5 cfddd56571b65dbbda6d21f0da86ad21
SHA1 85e25f55c2e1acc0bedbbe52957b71dd8d7bd67c
SHA512 1d573803a4279135d03138206f2ec1f0ad6cdebba0b36b1764cb81fcafd9e4c852bb9146f98d0ad34c626b0e44451321cc81d9c4ade55a095bd9493dbed5039d
SSDEEP 6144:Koy+bnr+rp0yN90QEPtSuQ01UPEnMvmZJTWPhDxVm4qcGRy:sMrTy90zvp6PkpopC4qcuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2328559.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2328559.exe
Size 306KB
SHA256 0c42a24d5ce1064b90636bba362af524f2b56e9731a3383844050321c13fbec0
MD5 cfddd56571b65dbbda6d21f0da86ad21
SHA1 85e25f55c2e1acc0bedbbe52957b71dd8d7bd67c
SHA512 1d573803a4279135d03138206f2ec1f0ad6cdebba0b36b1764cb81fcafd9e4c852bb9146f98d0ad34c626b0e44451321cc81d9c4ade55a095bd9493dbed5039d
SSDEEP 6144:Koy+bnr+rp0yN90QEPtSuQ01UPEnMvmZJTWPhDxVm4qcGRy:sMrTy90zvp6PkpopC4qcuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7043037.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7043037.exe
Size 145KB
SHA256 eca62987d5ec5606279107778c9223667b9d9e7f30b8fda9cacfc501a3fbc2e0
MD5 80dc9a6573588176eb6516ed2b766f86
SHA1 f1df20d8a90f02bd8e85cd7858105c2a73a63c0f
SHA512 c54b47451f9efe801d4ab62abb7f8fb89be6edd3fda815fc1319973059474376e84495e9e2d30eac5d9297d9751df668091c908838579376ed3a3bd90bb9e08c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7043037.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7043037.exe
Size 145KB
SHA256 eca62987d5ec5606279107778c9223667b9d9e7f30b8fda9cacfc501a3fbc2e0
MD5 80dc9a6573588176eb6516ed2b766f86
SHA1 f1df20d8a90f02bd8e85cd7858105c2a73a63c0f
SHA512 c54b47451f9efe801d4ab62abb7f8fb89be6edd3fda815fc1319973059474376e84495e9e2d30eac5d9297d9751df668091c908838579376ed3a3bd90bb9e08c
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1172-154-0x00000000004B0000-0x00000000004DA000-memory.dmp

Download

memory/1172-155-0x00000000053D0000-0x00000000059E8000-memory.dmp

Download

memory/1172-156-0x0000000004F50000-0x000000000505A000-memory.dmp

Download

memory/1172-157-0x0000000004E80000-0x0000000004E92000-memory.dmp

Download

memory/1172-158-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

Download

memory/1172-159-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/1172-160-0x0000000005210000-0x0000000005220000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads