redline | 71bcb1851ebe01fac653044ac2614c6b9bfa6db5bf804e04b7757ba1f3fee6f8

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 581KB
Sample230605-af2lqaeg4x
SHA256 71bcb1851ebe01fac653044ac2614c6b9bfa6db5bf804e04b7757ba1f3fee6f8
MD5 07c030e93757eb7f2fddac0712f5bc76
SHA1 ec3ad74e5d71383a0ae10ce9493698b9b4a8c55c
SHA512 7f021cc64e9ce1f9392e98dd844ecb9d6b3cc8fbcb2dab4b2262668140c33c11157582cf7b1425501e9b9a5875cdf3f16d00b5ac35a29f0940c9abf3ebb721be
SSDEEP 12288:sMr2y90OzpoMz5d9y9veDcopZjeJ8MIdWbLWrcSFhEEpN/m3va0:6yhHH9yUw4ijOr/FyM/mfa0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2548	x2734574.exe
60	x1901226.exe
4772	f3421548.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2734574.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2734574.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1901226.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x1901226.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe
4772	f3421548.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	f3421548.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2548	4848	file.exe	81
PID 4848 wrote to memory of 2548	4848	file.exe	81
PID 4848 wrote to memory of 2548	4848	file.exe	81
PID 2548 wrote to memory of 60	2548	x2734574.exe	82
PID 2548 wrote to memory of 60	2548	x2734574.exe	82
PID 2548 wrote to memory of 60	2548	x2734574.exe	82
PID 60 wrote to memory of 4772	60	x1901226.exe	83
PID 60 wrote to memory of 4772	60	x1901226.exe	83
PID 60 wrote to memory of 4772	60	x1901226.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2734574.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2734574.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1901226.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1901226.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3421548.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3421548.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2734574.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2734574.exe
Size 377KB
SHA256 49f4f2563267df4d2d90a4028b9ffea5483882c8387107fe67cfd30a696fef48
MD5 a23d1af9837bc7d516e6a75263f8fdf2
SHA1 f9fdbd7f3edc075fa8b5f13a0565f5d77b62368e
SHA512 e9803ecf4541ddd1e6ab131dce8fddbb8e298e012ab373fd4fabd71ee58f331841cbcf33c52546eed8282807342ca44c3563413184890b3114a923ff5f74c9f2
SSDEEP 6144:Khy+bnr+Kp0yN90QEZ/8PkOkvG4MftTa/NDGpxjeMgFWTWuGcM8CV2dWyDJpNK7V:jMryy90fkPkfvJiGopxjeJ8MIdWyLNQV
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2734574.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2734574.exe
Size 377KB
SHA256 49f4f2563267df4d2d90a4028b9ffea5483882c8387107fe67cfd30a696fef48
MD5 a23d1af9837bc7d516e6a75263f8fdf2
SHA1 f9fdbd7f3edc075fa8b5f13a0565f5d77b62368e
SHA512 e9803ecf4541ddd1e6ab131dce8fddbb8e298e012ab373fd4fabd71ee58f331841cbcf33c52546eed8282807342ca44c3563413184890b3114a923ff5f74c9f2
SSDEEP 6144:Khy+bnr+Kp0yN90QEZ/8PkOkvG4MftTa/NDGpxjeMgFWTWuGcM8CV2dWyDJpNK7V:jMryy90fkPkfvJiGopxjeJ8MIdWyLNQV
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1901226.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1901226.exe
Size 206KB
SHA256 62fe7442c4c690ff9617eba67f873c0e4ec5a1d0e6dded51b6372a8c7d2c8b6c
MD5 6b453dd0cda1cafe01acfaa62d8d9c93
SHA1 e8fc596256e7eafa9f29af19ef50a9845fd1faa6
SHA512 15c3bbaae98ca5ffef1f47862f42f5c881f1743b8bdd2b6e8991514bf859858c0de91f2c7469cd2fa42dca0b832a1fbdd08293c1d7580758816f9e04304b5858
SSDEEP 3072:Kdy+bnr+O1I5GWp1icKAArDZz4N9GhbkrNEk1mJGRE2EN6iIH4wGWgeEoI:Kdy+bnr+np0yN90QEnJ6ENTUvzbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1901226.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1901226.exe
Size 206KB
SHA256 62fe7442c4c690ff9617eba67f873c0e4ec5a1d0e6dded51b6372a8c7d2c8b6c
MD5 6b453dd0cda1cafe01acfaa62d8d9c93
SHA1 e8fc596256e7eafa9f29af19ef50a9845fd1faa6
SHA512 15c3bbaae98ca5ffef1f47862f42f5c881f1743b8bdd2b6e8991514bf859858c0de91f2c7469cd2fa42dca0b832a1fbdd08293c1d7580758816f9e04304b5858
SSDEEP 3072:Kdy+bnr+O1I5GWp1icKAArDZz4N9GhbkrNEk1mJGRE2EN6iIH4wGWgeEoI:Kdy+bnr+np0yN90QEnJ6ENTUvzbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3421548.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3421548.exe
Size 172KB
SHA256 3779ef7b603037321de30174ee9e8cf7c31d938bdda8a9af1925f46b0082592b
MD5 daf3e7db4afa923028be9a6db8bbbc74
SHA1 8cead347052df99013519b8a4a1909455add5d11
SHA512 c36597b116fd9a953b830f8018c2f46e9b3f767b3d126d0074f6a4aee7d5800c3428ac7a0be25c3d500722abcb39e60ea8050be5b6ec9fcae9e6108b98222859
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3421548.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3421548.exe
Size 172KB
SHA256 3779ef7b603037321de30174ee9e8cf7c31d938bdda8a9af1925f46b0082592b
MD5 daf3e7db4afa923028be9a6db8bbbc74
SHA1 8cead347052df99013519b8a4a1909455add5d11
SHA512 c36597b116fd9a953b830f8018c2f46e9b3f767b3d126d0074f6a4aee7d5800c3428ac7a0be25c3d500722abcb39e60ea8050be5b6ec9fcae9e6108b98222859
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4772-154-0x0000000000E60000-0x0000000000E90000-memory.dmp

Download

memory/4772-155-0x000000000B1A0000-0x000000000B7B8000-memory.dmp

Download

memory/4772-156-0x000000000ACA0000-0x000000000ADAA000-memory.dmp

Download

memory/4772-157-0x000000000ABE0000-0x000000000ABF2000-memory.dmp

Download

memory/4772-158-0x000000000AC40000-0x000000000AC7C000-memory.dmp

Download

memory/4772-159-0x00000000057F0000-0x0000000005800000-memory.dmp

Download

memory/4772-160-0x000000000AF50000-0x000000000AFC6000-memory.dmp

Download

memory/4772-161-0x000000000B070000-0x000000000B102000-memory.dmp

Download

memory/4772-162-0x000000000BD70000-0x000000000C314000-memory.dmp

Download

memory/4772-163-0x000000000B110000-0x000000000B176000-memory.dmp

Download

memory/4772-164-0x000000000BCA0000-0x000000000BCF0000-memory.dmp

Download

memory/4772-165-0x00000000057F0000-0x0000000005800000-memory.dmp

Download

memory/4772-166-0x000000000C5F0000-0x000000000C7B2000-memory.dmp

Download

memory/4772-167-0x000000000CCF0000-0x000000000D21C000-memory.dmp

Download