redline | a60c8cb5d8737d96445ebda7f8c5fbb445d78f77758e728c0b25b89e11538cc9

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 581KB
Sample230605-ajbjpseg7t
SHA256 a60c8cb5d8737d96445ebda7f8c5fbb445d78f77758e728c0b25b89e11538cc9
MD5 8259a24718f2e8004e1b92c29a88a909
SHA1 3c255d094f53907a6d21c5ed1d33875722852e67
SHA512 39631047a7161379f9a6a1a17ce5eeb63a3f6303946e2dff7d3f49cc93d60bf03884ad923c31e528945220f16b2d8587fa0960f897a75025f42cbad4ae1762ba
SSDEEP 6144:KWy+bnr+Dp0yN90QE1E7pteKJ9U1Q/xh1Zi5vc1JKaE3aRG9SUNA/lqo7dTeAIo0:WMrfy90c7aKJ3RyUXTv09SUq55FNVrY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19046

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1544	x0319844.exe
1292	x3848403.exe
1788	f9399525.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x0319844.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x0319844.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3848403.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3848403.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1788	f9399525.exe
1788	f9399525.exe
1788	f9399525.exe
1788	f9399525.exe
1788	f9399525.exe
1788	f9399525.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	f9399525.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1544	1124	file.exe	84
PID 1124 wrote to memory of 1544	1124	file.exe	84
PID 1124 wrote to memory of 1544	1124	file.exe	84
PID 1544 wrote to memory of 1292	1544	x0319844.exe	85
PID 1544 wrote to memory of 1292	1544	x0319844.exe	85
PID 1544 wrote to memory of 1292	1544	x0319844.exe	85
PID 1292 wrote to memory of 1788	1292	x3848403.exe	86
PID 1292 wrote to memory of 1788	1292	x3848403.exe	86
PID 1292 wrote to memory of 1788	1292	x3848403.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0319844.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0319844.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3848403.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3848403.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9399525.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9399525.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x0319844.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0319844.exe
Size 377KB
SHA256 102cb21f9f905035c55438a37ac63f164033831fd9b3489ba43202fbdc0175ef
MD5 a181af4242f9e63221865860a8ddf69b
SHA1 cb0af6f5a1d9a92ccc1e69eed0945644b5e04f8a
SHA512 54beee5a2766ef0d339b8ec88db219923b2519059d7dd238a3caa967aa47d60d96239a3f5f8653828b3402c3750d8cae139917bb81ec77424a8a0c69687fc9a4
SSDEEP 6144:Kzy+bnr+Cp0yN90QEPL7oPwvVCvDiiyQc1JXaE3aPG9SUNhclqP78:hMrCy90lMPwgQNXKv+9SUa68
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0319844.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0319844.exe
Size 377KB
SHA256 102cb21f9f905035c55438a37ac63f164033831fd9b3489ba43202fbdc0175ef
MD5 a181af4242f9e63221865860a8ddf69b
SHA1 cb0af6f5a1d9a92ccc1e69eed0945644b5e04f8a
SHA512 54beee5a2766ef0d339b8ec88db219923b2519059d7dd238a3caa967aa47d60d96239a3f5f8653828b3402c3750d8cae139917bb81ec77424a8a0c69687fc9a4
SSDEEP 6144:Kzy+bnr+Cp0yN90QEPL7oPwvVCvDiiyQc1JXaE3aPG9SUNhclqP78:hMrCy90lMPwgQNXKv+9SUa68
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3848403.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3848403.exe
Size 206KB
SHA256 d3b2b62216e996445f2b4c2215da1a59bfb99df6a4e7f42fe6637ca175fcabfb
MD5 8a6d4e2b396aeeb6155f936a08e77a12
SHA1 c8ba446d0f98d3336e1559934a08016c503eac33
SHA512 de50bf3f48cbbb9c116ab6424c02d86f2646214c209c0c3dd553a067dbd74980126939a42014f4c292f579dedc98679083d0f3a0c6703bca51fa41b817468f14
SSDEEP 3072:K8y+bnr+O1m5GWp1icKAArDZz4N9GhbkrNEk1OJGRE2EN6iIHnXNodcow:K8y+bnr+hp0yN90QEDJ6ENTUdoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3848403.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3848403.exe
Size 206KB
SHA256 d3b2b62216e996445f2b4c2215da1a59bfb99df6a4e7f42fe6637ca175fcabfb
MD5 8a6d4e2b396aeeb6155f936a08e77a12
SHA1 c8ba446d0f98d3336e1559934a08016c503eac33
SHA512 de50bf3f48cbbb9c116ab6424c02d86f2646214c209c0c3dd553a067dbd74980126939a42014f4c292f579dedc98679083d0f3a0c6703bca51fa41b817468f14
SSDEEP 3072:K8y+bnr+O1m5GWp1icKAArDZz4N9GhbkrNEk1OJGRE2EN6iIHnXNodcow:K8y+bnr+hp0yN90QEDJ6ENTUdoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9399525.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9399525.exe
Size 172KB
SHA256 34f2979168b8762ffbc7fe7641db8da4974cb35d6247e8d4e31851c80b6cbff1
MD5 ef25556f77c89f6567aaf7af0a25fc47
SHA1 97937c5c8fb8e739a3e22e9da948c0281148e6db
SHA512 c79b52fa89d474ede64ad7f7827f44b22aa1b85e1e8c0309d97323a2f11fb1a66be218a2b0c321245f9c38feaaceb19d1671ff8831e0babcb952ffba25f0b6d0
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9399525.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9399525.exe
Size 172KB
SHA256 34f2979168b8762ffbc7fe7641db8da4974cb35d6247e8d4e31851c80b6cbff1
MD5 ef25556f77c89f6567aaf7af0a25fc47
SHA1 97937c5c8fb8e739a3e22e9da948c0281148e6db
SHA512 c79b52fa89d474ede64ad7f7827f44b22aa1b85e1e8c0309d97323a2f11fb1a66be218a2b0c321245f9c38feaaceb19d1671ff8831e0babcb952ffba25f0b6d0
SSDEEP 1536:WEXFbl9T36sv0W7T6ZnCrHpd9YCOedT4uKbxNoUYQ5NbuQLOorhQ9Np0GkRf8e8f:zXFl9pcY9J1WXbxNC2KohQ9Npc8e8ht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1788-154-0x0000000000F50000-0x0000000000F80000-memory.dmp

Download

memory/1788-155-0x000000000B210000-0x000000000B828000-memory.dmp

Download

memory/1788-156-0x000000000AD90000-0x000000000AE9A000-memory.dmp

Download

memory/1788-157-0x000000000ACD0000-0x000000000ACE2000-memory.dmp

Download

memory/1788-158-0x000000000AD30000-0x000000000AD6C000-memory.dmp

Download

memory/1788-159-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/1788-160-0x000000000B140000-0x000000000B1B6000-memory.dmp

Download

memory/1788-161-0x000000000B8D0000-0x000000000B962000-memory.dmp

Download

memory/1788-162-0x000000000BF20000-0x000000000C4C4000-memory.dmp

Download

memory/1788-163-0x000000000B9E0000-0x000000000BA46000-memory.dmp

Download

memory/1788-164-0x000000000C6A0000-0x000000000C862000-memory.dmp

Download

memory/1788-165-0x000000000CDA0000-0x000000000D2CC000-memory.dmp

Download

memory/1788-166-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/1788-167-0x000000000C510000-0x000000000C560000-memory.dmp

Download