redline | 0f45ebf9c23d99bf17fa0a32e1d42a05b263dc1187852b89b56f104cdcbc9e57

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d0252f685e5f96cbbde6df3c576374fe.exe
Size 584KB
Sample230606-cp6m5sbf79
SHA256 0f45ebf9c23d99bf17fa0a32e1d42a05b263dc1187852b89b56f104cdcbc9e57
MD5 d0252f685e5f96cbbde6df3c576374fe
SHA1 513f140cf41a339f7a966d7744fe9ba64196bf3e
SHA512 346ebc0050a4d21cfb2699ec5b1bd6af2a397b7787ac3bba3bc2bd50d79dfc86a085bee767c97228b001f4ce61a543ad31402edbef0adde317ffe3fcd56b6fd3
SSDEEP 12288:AMrQy9089KKDw7Wp4xVMEFZP/t0hPSGEUbVflHJSyW:gynlsya5IRE8fW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3528	x1841461.exe
1108	x5522382.exe
1648	f4893412.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d0252f685e5f96cbbde6df3c576374fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d0252f685e5f96cbbde6df3c576374fe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1841461.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1841461.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5522382.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5522382.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3528	2092	d0252f685e5f96cbbde6df3c576374fe.exe	83
PID 2092 wrote to memory of 3528	2092	d0252f685e5f96cbbde6df3c576374fe.exe	83
PID 2092 wrote to memory of 3528	2092	d0252f685e5f96cbbde6df3c576374fe.exe	83
PID 3528 wrote to memory of 1108	3528	x1841461.exe	84
PID 3528 wrote to memory of 1108	3528	x1841461.exe	84
PID 3528 wrote to memory of 1108	3528	x1841461.exe	84
PID 1108 wrote to memory of 1648	1108	x5522382.exe	85
PID 1108 wrote to memory of 1648	1108	x5522382.exe	85
PID 1108 wrote to memory of 1648	1108	x5522382.exe	85

C:\Users\Admin\AppData\Local\Temp\d0252f685e5f96cbbde6df3c576374fe.exe
"C:\Users\Admin\AppData\Local\Temp\d0252f685e5f96cbbde6df3c576374fe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1841461.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1841461.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5522382.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5522382.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4893412.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4893412.exe
      4⤵
      Executes dropped EXE
      PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1841461.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1841461.exe
Size 378KB
SHA256 b560899ed759e7e36b5e46f4846572ab9284c32bd4f6721ec2ed406297ebfe49
MD5 4ae699982166be59430f623197c99501
SHA1 953dad622058ac72888c9b692ebac55a0e31755b
SHA512 79afa0461be44e3fc91de73061cb05bb2e0555946d927dff50d2dc1150c282d9e6327fb170ed324bd574e6a38baa105acacee1384966228e05c9f933487ff2c7
SSDEEP 6144:K4y+bnr+0p0yN90QETQhtt2lPjhVX8EFZP5M8GEcH0/cHRM5:kMr8y90ZQnt2XVMEFZP+b0/YS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1841461.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1841461.exe
Size 378KB
SHA256 b560899ed759e7e36b5e46f4846572ab9284c32bd4f6721ec2ed406297ebfe49
MD5 4ae699982166be59430f623197c99501
SHA1 953dad622058ac72888c9b692ebac55a0e31755b
SHA512 79afa0461be44e3fc91de73061cb05bb2e0555946d927dff50d2dc1150c282d9e6327fb170ed324bd574e6a38baa105acacee1384966228e05c9f933487ff2c7
SSDEEP 6144:K4y+bnr+0p0yN90QETQhtt2lPjhVX8EFZP5M8GEcH0/cHRM5:kMr8y90ZQnt2XVMEFZP+b0/YS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5522382.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5522382.exe
Size 206KB
SHA256 cf4d7b19c07a69ae9000c291aed5cc4a456e499c7a26216ed74b9f668c44c49c
MD5 2ae179f3212a92eaacc40f8dd66568e1
SHA1 bc9a29ebacf8597f2464b6c99f840ddda60eee14
SHA512 802292ed4b60ed54416d118ba2b960d7ab36f09c1f3aad1f2a37f2ccc48d198dc8da82fdd416771ea1235b6d50654f0c154faf176032b6ea8bc1b881139099d1
SSDEEP 3072:Kqy+bnr+O1v5GWp1icKAArDZz4N9GhbkrNEk1fNyQqfXkEy+uH4WaiWX2Velob:Kqy+bnr+op0yN90QEWyQqf0QWa6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5522382.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5522382.exe
Size 206KB
SHA256 cf4d7b19c07a69ae9000c291aed5cc4a456e499c7a26216ed74b9f668c44c49c
MD5 2ae179f3212a92eaacc40f8dd66568e1
SHA1 bc9a29ebacf8597f2464b6c99f840ddda60eee14
SHA512 802292ed4b60ed54416d118ba2b960d7ab36f09c1f3aad1f2a37f2ccc48d198dc8da82fdd416771ea1235b6d50654f0c154faf176032b6ea8bc1b881139099d1
SSDEEP 3072:Kqy+bnr+O1v5GWp1icKAArDZz4N9GhbkrNEk1fNyQqfXkEy+uH4WaiWX2Velob:Kqy+bnr+op0yN90QEWyQqf0QWa6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

f4893412.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4893412.exe
Size 172KB
SHA256 68789e64f2467a3e562a9eb1f33655e16fc41847565d611e63585d997e08e958
MD5 9ca9c4376b20d89f35e1a4142abea67d
SHA1 b3ce005a53624b3df90ba53d22207f51dda747e3
SHA512 7e362fc0a32448ee4c0f4393f311ead8527a02ad45ef3d403ece8059975a4d3c98cf146a08f723102b1411b9eaccff5005145851c9b3a643fcfa4094946dbe2a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f4893412.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4893412.exe
Size 172KB
SHA256 68789e64f2467a3e562a9eb1f33655e16fc41847565d611e63585d997e08e958
MD5 9ca9c4376b20d89f35e1a4142abea67d
SHA1 b3ce005a53624b3df90ba53d22207f51dda747e3
SHA512 7e362fc0a32448ee4c0f4393f311ead8527a02ad45ef3d403ece8059975a4d3c98cf146a08f723102b1411b9eaccff5005145851c9b3a643fcfa4094946dbe2a
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1648-154-0x00000000008A0000-0x00000000008D0000-memory.dmp

Download

memory/1648-155-0x000000000AC10000-0x000000000B228000-memory.dmp

Download

memory/1648-156-0x000000000A700000-0x000000000A80A000-memory.dmp

Download

memory/1648-157-0x000000000A620000-0x000000000A632000-memory.dmp

Download

memory/1648-158-0x000000000A680000-0x000000000A6BC000-memory.dmp

Download

memory/1648-159-0x0000000005260000-0x0000000005270000-memory.dmp

Download

memory/1648-160-0x0000000005260000-0x0000000005270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads