redline | 7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af

General

Target

7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe
Size

1.0MB
MD5

06318fc844c1a651c676936d83a63493
SHA1

d9b6e2623f3ab4f63e00601df58b826f490eafce
SHA256

7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af
SHA512

ad6dfb452970a299a26fb25dd329605260b499bbd7c946ca63fd1ecc96f54f347e7b9232376b974f85052ab1d7db0bd42d1799a2bf30cfcf46c86fe8842e5d31
SSDEEP

24576:Ny4PdtC1I5OOwbx5E84bpzjFIRlm1ry9nbobyW46BOLTM:oMKcOOU5E5pcnEt46BOLT

Score

10^/10

redline daza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

daza

C2

77.91.124.251:19065

Attributes

auth_value
0bd5963efefdd6409185423d5ca3439c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3076	x4285961.exe
4532	x4379290.exe
4988	f8024933.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4285961.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4285961.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4379290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4379290.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3076	2876	7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe	66
PID 2876 wrote to memory of 3076	2876	7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe	66
PID 2876 wrote to memory of 3076	2876	7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe	66
PID 3076 wrote to memory of 4532	3076	x4285961.exe	67
PID 3076 wrote to memory of 4532	3076	x4285961.exe	67
PID 3076 wrote to memory of 4532	3076	x4285961.exe	67
PID 4532 wrote to memory of 4988	4532	x4379290.exe	68
PID 4532 wrote to memory of 4988	4532	x4379290.exe	68
PID 4532 wrote to memory of 4988	4532	x4379290.exe	68

C:\Users\Admin\AppData\Local\Temp\7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe
"C:\Users\Admin\AppData\Local\Temp\7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4285961.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4285961.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4379290.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4379290.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8024933.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8024933.exe
      4⤵
      Executes dropped EXE
      PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4285961.exe

Filesize
750KB

MD5
474042692f8ea56293cc85bf8b4c38d9

SHA1
e70413a48bca1ee3c59476ab13c79f29212303de

SHA256
7ad81d45edd842b1a824158cdecaf7dd29d3b007274c2987e4bf5127a0e0de64

SHA512
3d3b4b410b70b10d8d01b8a7901b7849d6f1c4926d0ebbb203f4e564389c2f044a5b5e0d6bbaff43d94cdbcaff5b314b9e35731d9ee9e7dcf0ccb778c16cab0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4285961.exe

Filesize
750KB

MD5
474042692f8ea56293cc85bf8b4c38d9

SHA1
e70413a48bca1ee3c59476ab13c79f29212303de

SHA256
7ad81d45edd842b1a824158cdecaf7dd29d3b007274c2987e4bf5127a0e0de64

SHA512
3d3b4b410b70b10d8d01b8a7901b7849d6f1c4926d0ebbb203f4e564389c2f044a5b5e0d6bbaff43d94cdbcaff5b314b9e35731d9ee9e7dcf0ccb778c16cab0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4379290.exe

Filesize
306KB

MD5
3dc57f5bb5c04d9cfe36c829027d3d79

SHA1
7d0f6a6c5dfee5073f651f9fa5f0dd3335756a80

SHA256
c07fec8646b23eaff1919d52960f73fc66071fe262533c92f032a6efdc431b65

SHA512
0a6817f357298ccd192773ac8f1a698e2d55c9a068c4d0f84616f502b3c1328878f74a8a24e736831dc28ba77dcfa4401248b1ccbe443d9c43f79fede6e9a9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4379290.exe

Filesize
306KB

MD5
3dc57f5bb5c04d9cfe36c829027d3d79

SHA1
7d0f6a6c5dfee5073f651f9fa5f0dd3335756a80

SHA256
c07fec8646b23eaff1919d52960f73fc66071fe262533c92f032a6efdc431b65

SHA512
0a6817f357298ccd192773ac8f1a698e2d55c9a068c4d0f84616f502b3c1328878f74a8a24e736831dc28ba77dcfa4401248b1ccbe443d9c43f79fede6e9a9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8024933.exe

Filesize
145KB

MD5
24b22b9803fd58829cc523ae01ed76e9

SHA1
41f3210cfc3092dbad92f235dc72aa495a62610e

SHA256
47d8c5d02090a0fe80a47557f47a3181c24216854b9e22d0b88b7ac833aa68d4

SHA512
79513547c634969d14d8b9ffabd93a3ed1de61cba7b9d720baf6101b390f6ca711b1911785b5bd0d1b36173d9711baf53f95de38fdbf479080cc274610fcbefa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8024933.exe

Filesize
145KB

MD5
24b22b9803fd58829cc523ae01ed76e9

SHA1
41f3210cfc3092dbad92f235dc72aa495a62610e

SHA256
47d8c5d02090a0fe80a47557f47a3181c24216854b9e22d0b88b7ac833aa68d4

SHA512
79513547c634969d14d8b9ffabd93a3ed1de61cba7b9d720baf6101b390f6ca711b1911785b5bd0d1b36173d9711baf53f95de38fdbf479080cc274610fcbefa

Download Submit
memory/4988-140-0x0000000000DC0000-0x0000000000DEA000-memory.dmp

Filesize
168KB

Download
memory/4988-141-0x0000000005B50000-0x0000000006156000-memory.dmp

Filesize
6.0MB

Download
memory/4988-142-0x00000000056E0000-0x00000000057EA000-memory.dmp

Filesize
1.0MB

Download
memory/4988-143-0x0000000005610000-0x0000000005622000-memory.dmp

Filesize
72KB

Download
memory/4988-144-0x0000000005670000-0x00000000056AE000-memory.dmp

Filesize
248KB

Download
memory/4988-145-0x00000000057F0000-0x000000000583B000-memory.dmp

Filesize
300KB

Download
memory/4988-146-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4988-147-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing