redline | c612fffc0085b0aa52db0740bf0414806671a08d68e1fd0e755928af886a26a9

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fd73b97e5cafadfd9e180ebab390001.exe
Size 585KB
Sample230606-nmpsdsdd37
SHA256 c612fffc0085b0aa52db0740bf0414806671a08d68e1fd0e755928af886a26a9
MD5 4fd73b97e5cafadfd9e180ebab390001
SHA1 8d0aa05d90c6d1fb87a006d0139a62e9766861fc
SHA512 01b269b3806a97f5705a8abf8ad61809fabd5a8311ef431c937eec5dd6112b11a747ebffdb3bf6b23f244639b9f8737ccd7edcead01a0f20ed3731af02a219c7
SSDEEP 12288:ZMrmy906d/ZtJ2AOqOD0Acf2tWIPgZXPyaC5+BYruKqgpd:Dy5Pz2gORcf24OgKH+BJzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1916	x6235427.exe
2212	x8387392.exe
4280	f5510158.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6235427.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8387392.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8387392.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4fd73b97e5cafadfd9e180ebab390001.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4fd73b97e5cafadfd9e180ebab390001.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6235427.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe
4280	f5510158.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	f5510158.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1916	4376	4fd73b97e5cafadfd9e180ebab390001.exe	85
PID 4376 wrote to memory of 1916	4376	4fd73b97e5cafadfd9e180ebab390001.exe	85
PID 4376 wrote to memory of 1916	4376	4fd73b97e5cafadfd9e180ebab390001.exe	85
PID 1916 wrote to memory of 2212	1916	x6235427.exe	86
PID 1916 wrote to memory of 2212	1916	x6235427.exe	86
PID 1916 wrote to memory of 2212	1916	x6235427.exe	86
PID 2212 wrote to memory of 4280	2212	x8387392.exe	87
PID 2212 wrote to memory of 4280	2212	x8387392.exe	87
PID 2212 wrote to memory of 4280	2212	x8387392.exe	87

C:\Users\Admin\AppData\Local\Temp\4fd73b97e5cafadfd9e180ebab390001.exe
"C:\Users\Admin\AppData\Local\Temp\4fd73b97e5cafadfd9e180ebab390001.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6235427.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6235427.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8387392.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8387392.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5510158.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5510158.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x6235427.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6235427.exe
Size 378KB
SHA256 376ac2aea3847bc49cdc010166b798584a7b3a03721433dc2bfc37ab144fecc3
MD5 f5b5bf90b667ec99c201745c4fefe0a9
SHA1 86ba20c5749edd0736c4f81f8d7fa6fe41b52ccd
SHA512 3532b1feca8d7f8fcca70072f75325ecbadaecd8c1b1205aa60b9a3f5d43f12873fc6f55ff9c46f0b6469a46f69321ff6cb214e92f075bdd20a84ba2c9c08136
SSDEEP 6144:KCy+bnr+0p0yN90QE1FEDxue5DcN+XpZjw1WYyKuHDl2tWdIPA4zWfXPslpyt89:aMr0y903Og0wPu2t2IPHiXPGyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6235427.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6235427.exe
Size 378KB
SHA256 376ac2aea3847bc49cdc010166b798584a7b3a03721433dc2bfc37ab144fecc3
MD5 f5b5bf90b667ec99c201745c4fefe0a9
SHA1 86ba20c5749edd0736c4f81f8d7fa6fe41b52ccd
SHA512 3532b1feca8d7f8fcca70072f75325ecbadaecd8c1b1205aa60b9a3f5d43f12873fc6f55ff9c46f0b6469a46f69321ff6cb214e92f075bdd20a84ba2c9c08136
SSDEEP 6144:KCy+bnr+0p0yN90QE1FEDxue5DcN+XpZjw1WYyKuHDl2tWdIPA4zWfXPslpyt89:aMr0y903Og0wPu2t2IPHiXPGyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8387392.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8387392.exe
Size 206KB
SHA256 ddb9003546579a019f80b86d902c1c191c3bc463db00a73e465d2ce53839b873
MD5 a09e8ceb7d7e0146190846201c097ce6
SHA1 fce8c9d2316f7c01bc6a58157eb0bbfbe2b09078
SHA512 432bd7fbbbbed2bd7f68d8f2f89e088ab7015f422c3f853e2e15c27307aed68d1bf5702510666a22d2a7293edd234c8c64fc114de8e6e79896430f6b91834e96
SSDEEP 3072:Kky+bnr+O1A5GWp1icKAArDZz4N9GhbkrNEk16NyQqfXkEy+uH4WaiWX2Vnzaoio:Kky+bnr+/p0yN90QEPyQqf0QWa6Raoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8387392.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8387392.exe
Size 206KB
SHA256 ddb9003546579a019f80b86d902c1c191c3bc463db00a73e465d2ce53839b873
MD5 a09e8ceb7d7e0146190846201c097ce6
SHA1 fce8c9d2316f7c01bc6a58157eb0bbfbe2b09078
SHA512 432bd7fbbbbed2bd7f68d8f2f89e088ab7015f422c3f853e2e15c27307aed68d1bf5702510666a22d2a7293edd234c8c64fc114de8e6e79896430f6b91834e96
SSDEEP 3072:Kky+bnr+O1A5GWp1icKAArDZz4N9GhbkrNEk16NyQqfXkEy+uH4WaiWX2Vnzaoio:Kky+bnr+/p0yN90QEPyQqf0QWa6Raoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5510158.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5510158.exe
Size 172KB
SHA256 ea28a4bde6f6f5c57c5fbe3f573dd0c837d233349fe2ccc27e864d64b8bfbad3
MD5 0f2a34087b038bc1d8d95ae07d85f559
SHA1 8d99ab1d3ab2ef853b3e3081cc344bd39963011c
SHA512 e0268ee3cca062184879647b57893e97bb233ec1e4fcfbbef1e129c80b2c9ffe51fc3f32eb0e4b7eb879660e674b2abb3b950a592129a4cb629c93560a4ad732
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5510158.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5510158.exe
Size 172KB
SHA256 ea28a4bde6f6f5c57c5fbe3f573dd0c837d233349fe2ccc27e864d64b8bfbad3
MD5 0f2a34087b038bc1d8d95ae07d85f559
SHA1 8d99ab1d3ab2ef853b3e3081cc344bd39963011c
SHA512 e0268ee3cca062184879647b57893e97bb233ec1e4fcfbbef1e129c80b2c9ffe51fc3f32eb0e4b7eb879660e674b2abb3b950a592129a4cb629c93560a4ad732
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4280-154-0x0000000000960000-0x0000000000990000-memory.dmp

Download

memory/4280-155-0x00000000059B0000-0x0000000005FC8000-memory.dmp

Download

memory/4280-156-0x00000000054C0000-0x00000000055CA000-memory.dmp

Download

memory/4280-157-0x0000000005400000-0x0000000005412000-memory.dmp

Download

memory/4280-158-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4280-159-0x0000000005460000-0x000000000549C000-memory.dmp

Download

memory/4280-160-0x0000000005770000-0x00000000057E6000-memory.dmp

Download

memory/4280-161-0x0000000005890000-0x0000000005922000-memory.dmp

Download

memory/4280-162-0x00000000057F0000-0x0000000005856000-memory.dmp

Download

memory/4280-163-0x0000000006B70000-0x0000000007114000-memory.dmp

Download

memory/4280-164-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4280-165-0x0000000006730000-0x0000000006780000-memory.dmp

Download

memory/4280-166-0x0000000006950000-0x0000000006B12000-memory.dmp

Download

memory/4280-167-0x0000000008C40000-0x000000000916C000-memory.dmp

Download