redline | 126ef9f19be5549da0acca0ea1fc97a2612110b4bfaccd4a75072ff909e0a0b2

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 581KB
Sample230605-a7g2dsed32
SHA256 126ef9f19be5549da0acca0ea1fc97a2612110b4bfaccd4a75072ff909e0a0b2
MD5 3d65988d33c54809b425459a81094bc1
SHA1 d0a24c4e57c4af36c76c9cf2660b136fac5a7b2d
SHA512 cbba118962a8c13ae2e82eec808654e5170ae85979c76838b13648494a294b5a8e6bb8ff46a42a532e7e8f8c9a9ba1d9f39727965d36a3d4b440f22e95751424
SSDEEP 12288:gMrGy90gf+LNRmXzMQmK5U1PZK1BebyoZ7SEPyFKWs4mg:2y6LmXQrK5U1PZWQy+SEKFKr4mg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
396	x8308521.exe
812	x9254183.exe
3716	f6850097.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8308521.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x9254183.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x9254183.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8308521.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe
3716	f6850097.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	f6850097.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 396	3188	file.exe	83
PID 3188 wrote to memory of 396	3188	file.exe	83
PID 3188 wrote to memory of 396	3188	file.exe	83
PID 396 wrote to memory of 812	396	x8308521.exe	84
PID 396 wrote to memory of 812	396	x8308521.exe	84
PID 396 wrote to memory of 812	396	x8308521.exe	84
PID 812 wrote to memory of 3716	812	x9254183.exe	85
PID 812 wrote to memory of 3716	812	x9254183.exe	85
PID 812 wrote to memory of 3716	812	x9254183.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8308521.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8308521.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9254183.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9254183.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6850097.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6850097.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x8308521.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8308521.exe
Size 377KB
SHA256 a87bc88042468c137fcc3a468395b0810c4e82cf5c868de1df6569f759ce2bf6
MD5 882696e598996c36262f90bf6143308c
SHA1 9c099492bff6d6be688cb3e80b1012733e6f20df
SHA512 29f48a884ae0167f64d5d74e1259a9d1c0b4321db5735b78ad610be2fd9cbb2d69c1eef9947ffbb591908f6919b777cbaece915a37af492fac7537813ae7479f
SSDEEP 6144:KTy+bnr+cp0yN90QEaxnfzkR8DtuKRtDnI1sUbz8r2xnXuBiJcbu6maurGM26SpQ:RMrIy90sNriu5UDPZXuBLbyo67X3
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8308521.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8308521.exe
Size 377KB
SHA256 a87bc88042468c137fcc3a468395b0810c4e82cf5c868de1df6569f759ce2bf6
MD5 882696e598996c36262f90bf6143308c
SHA1 9c099492bff6d6be688cb3e80b1012733e6f20df
SHA512 29f48a884ae0167f64d5d74e1259a9d1c0b4321db5735b78ad610be2fd9cbb2d69c1eef9947ffbb591908f6919b777cbaece915a37af492fac7537813ae7479f
SSDEEP 6144:KTy+bnr+cp0yN90QEaxnfzkR8DtuKRtDnI1sUbz8r2xnXuBiJcbu6maurGM26SpQ:RMrIy90sNriu5UDPZXuBLbyo67X3
MD5 SHA1 SHA512 SSDEEP

Submit Download

x9254183.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9254183.exe
Size 206KB
SHA256 8a7edabf80f86030bd13b09624e9b8991203dcb21ec5fe9f6a082bbba7435d34
MD5 c3a8f06a555a0e871715eac7494ab65c
SHA1 5adc7b98a4029852d3ed0bcb026f79ca186a49cf
SHA512 74f967e705def3767413f573296863a4446acaedd39e05898fbf2242582ea4343490e4cec22927ecf8f77929316ce7bd20ffc21ca85f708aa13fb88e4d2169c1
SSDEEP 3072:Koy+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk1YJGRE2EN6iIHLrNoipow:Koy+bnr+dp0yN90QElJ6ENTUtov
MD5 SHA1 SHA512 SSDEEP

Submit Download

x9254183.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9254183.exe
Size 206KB
SHA256 8a7edabf80f86030bd13b09624e9b8991203dcb21ec5fe9f6a082bbba7435d34
MD5 c3a8f06a555a0e871715eac7494ab65c
SHA1 5adc7b98a4029852d3ed0bcb026f79ca186a49cf
SHA512 74f967e705def3767413f573296863a4446acaedd39e05898fbf2242582ea4343490e4cec22927ecf8f77929316ce7bd20ffc21ca85f708aa13fb88e4d2169c1
SSDEEP 3072:Koy+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk1YJGRE2EN6iIHLrNoipow:Koy+bnr+dp0yN90QElJ6ENTUtov
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6850097.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6850097.exe
Size 172KB
SHA256 3c45aecbf6ce1a4fee48c856ad1f192c463e2d1fba28194546431874527bbbc9
MD5 4b9f6dcd16e4bc4f0b8ffb40d9c3be31
SHA1 ec495ae78fc6922bfc68b90a5e2fa91147e8e07a
SHA512 371c2d628c24337cf3772593ed2f01bdba1c7c390204f537eae041fb9b6958874dd7b49b52b9c26965c0bdccba6f96a4c313d48287c2e53f85253cfb85f50165
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6850097.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6850097.exe
Size 172KB
SHA256 3c45aecbf6ce1a4fee48c856ad1f192c463e2d1fba28194546431874527bbbc9
MD5 4b9f6dcd16e4bc4f0b8ffb40d9c3be31
SHA1 ec495ae78fc6922bfc68b90a5e2fa91147e8e07a
SHA512 371c2d628c24337cf3772593ed2f01bdba1c7c390204f537eae041fb9b6958874dd7b49b52b9c26965c0bdccba6f96a4c313d48287c2e53f85253cfb85f50165
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3716-154-0x00000000003D0000-0x0000000000400000-memory.dmp

Download

memory/3716-155-0x000000000A6E0000-0x000000000ACF8000-memory.dmp

Download

memory/3716-156-0x000000000A210000-0x000000000A31A000-memory.dmp

Download

memory/3716-157-0x000000000A150000-0x000000000A162000-memory.dmp

Download

memory/3716-159-0x000000000A1B0000-0x000000000A1EC000-memory.dmp

Download

memory/3716-158-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3716-160-0x000000000A5C0000-0x000000000A636000-memory.dmp

Download

memory/3716-161-0x000000000AD00000-0x000000000AD92000-memory.dmp

Download

memory/3716-162-0x000000000B350000-0x000000000B8F4000-memory.dmp

Download

memory/3716-163-0x000000000ADA0000-0x000000000AE06000-memory.dmp

Download

memory/3716-164-0x000000000BAD0000-0x000000000BC92000-memory.dmp

Download

memory/3716-165-0x000000000C1D0000-0x000000000C6FC000-memory.dmp

Download

memory/3716-166-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3716-167-0x000000000B2C0000-0x000000000B310000-memory.dmp

Download