redline | 3b39d9d760fce51e7af5a8ccd343d363424babaf206247d3246f5aaf6006bca2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
input171.exe
Size 1.0MB
Sample230522-mwb28aaf7w
SHA256 3b39d9d760fce51e7af5a8ccd343d363424babaf206247d3246f5aaf6006bca2
MD5 2782c8b6d8251e594e4b9f6494571dff
SHA1 eb2fafec6b639a7d14f8c682741e25692ae14ace
SHA512 30d595c2bb66bfb5d1f033fe901dfaf2b61b1728d73ddc98d091ec313b29e2b894ee69f2e12c2da5c94e285d7c503216a4b14de961393fa1a01c2815803436b4
SSDEEP 24576:xyxjZXB3btA9YJOjXdlOyxBc/nZb8z9BOg12Jj:kx9x3btASJYbxkh85Y2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

185.161.248.37:4138

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2732	x1275024.exe
1400	x5460014.exe
2708	f8462269.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	input171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	input171.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1275024.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1275024.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5460014.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5460014.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2732	2456	input171.exe	85
PID 2456 wrote to memory of 2732	2456	input171.exe	85
PID 2456 wrote to memory of 2732	2456	input171.exe	85
PID 2732 wrote to memory of 1400	2732	x1275024.exe	86
PID 2732 wrote to memory of 1400	2732	x1275024.exe	86
PID 2732 wrote to memory of 1400	2732	x1275024.exe	86
PID 1400 wrote to memory of 2708	1400	x5460014.exe	87
PID 1400 wrote to memory of 2708	1400	x5460014.exe	87
PID 1400 wrote to memory of 2708	1400	x5460014.exe	87

C:\Users\Admin\AppData\Local\Temp\input171.exe
"C:\Users\Admin\AppData\Local\Temp\input171.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1275024.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1275024.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5460014.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5460014.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8462269.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8462269.exe
      4⤵
      Executes dropped EXE
      PID:2708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1275024.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1275024.exe
Size 750KB
SHA256 df5dc03df9de79415929391b143dc0c8ca0340d7da2ec09983036c1231943193
MD5 b4ba95439d3b4aa4f66b295ec4d50915
SHA1 5915d611475fe23ea86d73ef09c22efee8bf35cb
SHA512 bf32431aa02df12bc39830d4d0802a1d4400b62286cfb84108f58555b9afb80bdbf4e1208ab3e6aa92d9012d57b951a34ec318448ffae8addeb082f0a698a4e1
SSDEEP 12288:vMrKy901warzCEYYYcTa4gEjcdlOy9um/bm8mO6Ef676qC:9ytavCEYoXjcdlOyE8F36EfY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1275024.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1275024.exe
Size 750KB
SHA256 df5dc03df9de79415929391b143dc0c8ca0340d7da2ec09983036c1231943193
MD5 b4ba95439d3b4aa4f66b295ec4d50915
SHA1 5915d611475fe23ea86d73ef09c22efee8bf35cb
SHA512 bf32431aa02df12bc39830d4d0802a1d4400b62286cfb84108f58555b9afb80bdbf4e1208ab3e6aa92d9012d57b951a34ec318448ffae8addeb082f0a698a4e1
SSDEEP 12288:vMrKy901warzCEYYYcTa4gEjcdlOy9um/bm8mO6Ef676qC:9ytavCEYoXjcdlOyE8F36EfY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5460014.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5460014.exe
Size 306KB
SHA256 647ec8ff33ad6381e5efd037b1d27c6e18306993627bd589a9ffa5500546e9a2
MD5 ed4f1c2278e8654901808a1e60bc8401
SHA1 d7a8941865381b76df1114f9e9d219c171fc7254
SHA512 b5a1de8c53c17a66d2d895f83193717887177f068b2984c56118983f416a4c27c3271bc51665958d9b2bf7dbf231646e8f5b40cb6e92f389f9f33f8ddc5b280f
SSDEEP 6144:KQy+bnr+Jp0yN90QEFtSuQ01PJXqtTa3QVwrsKEm4O+Pd9:sMr9y90VvpNNcTm4KEhjd9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5460014.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5460014.exe
Size 306KB
SHA256 647ec8ff33ad6381e5efd037b1d27c6e18306993627bd589a9ffa5500546e9a2
MD5 ed4f1c2278e8654901808a1e60bc8401
SHA1 d7a8941865381b76df1114f9e9d219c171fc7254
SHA512 b5a1de8c53c17a66d2d895f83193717887177f068b2984c56118983f416a4c27c3271bc51665958d9b2bf7dbf231646e8f5b40cb6e92f389f9f33f8ddc5b280f
SSDEEP 6144:KQy+bnr+Jp0yN90QEFtSuQ01PJXqtTa3QVwrsKEm4O+Pd9:sMr9y90VvpNNcTm4KEhjd9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8462269.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8462269.exe
Size 146KB
SHA256 d0ee20773d1b5dacf2ab54ce51f677099021d2cb00befd3e6bafcc18a82b986e
MD5 983ecc69cf63ca2d7d39938054e5e1bc
SHA1 32673c7b5a20391fea9830c7e2afb075b28e7b44
SHA512 7b9e67cfab32a031ee14b65b82aa210f3f7367703322342cbd95e6efb3b9765f15149316f3713dfdfd9a4e95a6d250e5eac5525c59fe385404c33746df495ded
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8462269.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8462269.exe
Size 146KB
SHA256 d0ee20773d1b5dacf2ab54ce51f677099021d2cb00befd3e6bafcc18a82b986e
MD5 983ecc69cf63ca2d7d39938054e5e1bc
SHA1 32673c7b5a20391fea9830c7e2afb075b28e7b44
SHA512 7b9e67cfab32a031ee14b65b82aa210f3f7367703322342cbd95e6efb3b9765f15149316f3713dfdfd9a4e95a6d250e5eac5525c59fe385404c33746df495ded
SSDEEP 3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2708-154-0x0000000000CF0000-0x0000000000D1A000-memory.dmp

Download

memory/2708-155-0x0000000005C10000-0x0000000006228000-memory.dmp

Download

memory/2708-156-0x0000000005790000-0x000000000589A000-memory.dmp

Download

memory/2708-157-0x00000000056C0000-0x00000000056D2000-memory.dmp

Download

memory/2708-158-0x0000000005750000-0x000000000578C000-memory.dmp

Download

memory/2708-159-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/2708-160-0x0000000005740000-0x0000000005750000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads