redline | 75ac447cee842417c9a06011184e3dc5a2a768ac9a1eeab4d798e200ee9b9fd2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2023, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148a8363dcdd6b0e56eb564eff8004f5.exe
Size 585KB
Sample230606-redxpsea54
SHA256 75ac447cee842417c9a06011184e3dc5a2a768ac9a1eeab4d798e200ee9b9fd2
MD5 148a8363dcdd6b0e56eb564eff8004f5
SHA1 46880e430ed3046fbd4504faa8e92f2559a8d19f
SHA512 382dad0bdd3e5d73c71a5f2aa6d7580e6882755b590da2513cc040009186f4f84f71fcf7f69fabe53fadc9014541a18ddf416be01dedcd6f3eb2a21b68f223a8
SSDEEP 12288:UMrsy90zU/N1HvSz7rKePoAQypAZfA0YJhwZp+sdAVue:YySU/rSz77PoAQypAZfAjJhke
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1752	x1108969.exe
1564	x7406082.exe
1508	f9716960.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	148a8363dcdd6b0e56eb564eff8004f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	148a8363dcdd6b0e56eb564eff8004f5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1108969.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1108969.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7406082.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7406082.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1752	2600	148a8363dcdd6b0e56eb564eff8004f5.exe	83
PID 2600 wrote to memory of 1752	2600	148a8363dcdd6b0e56eb564eff8004f5.exe	83
PID 2600 wrote to memory of 1752	2600	148a8363dcdd6b0e56eb564eff8004f5.exe	83
PID 1752 wrote to memory of 1564	1752	x1108969.exe	84
PID 1752 wrote to memory of 1564	1752	x1108969.exe	84
PID 1752 wrote to memory of 1564	1752	x1108969.exe	84
PID 1564 wrote to memory of 1508	1564	x7406082.exe	85
PID 1564 wrote to memory of 1508	1564	x7406082.exe	85
PID 1564 wrote to memory of 1508	1564	x7406082.exe	85

C:\Users\Admin\AppData\Local\Temp\148a8363dcdd6b0e56eb564eff8004f5.exe
"C:\Users\Admin\AppData\Local\Temp\148a8363dcdd6b0e56eb564eff8004f5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1108969.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1108969.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7406082.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7406082.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9716960.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9716960.exe
      4⤵
      Executes dropped EXE
      PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1108969.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1108969.exe
Size 377KB
SHA256 a0d859fa8814e372cc8200226c1a182b56088bc15196cddd6bd5973bf35ad97f
MD5 2e0ff19c03898446783a9e0083864733
SHA1 f713e0d3b9d60bc542c0496b3eb8d41e8524e919
SHA512 4ad2fd3a6bb6b7664e3091ddcbe5400977aaead416c0394dfb853f68e5fd0df4b32d403bd990c1df17725b1f525a651d53a25658f383ededa42a84db95a99639
SSDEEP 6144:KBy+bnr+Gp0yN90QEY9Kcamcewji45bq3amAZiNQypp0GC5usfuG0YLsDMkRIju1:bMrmy906pamLyiQPFCQypQZfN0YIr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1108969.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1108969.exe
Size 377KB
SHA256 a0d859fa8814e372cc8200226c1a182b56088bc15196cddd6bd5973bf35ad97f
MD5 2e0ff19c03898446783a9e0083864733
SHA1 f713e0d3b9d60bc542c0496b3eb8d41e8524e919
SHA512 4ad2fd3a6bb6b7664e3091ddcbe5400977aaead416c0394dfb853f68e5fd0df4b32d403bd990c1df17725b1f525a651d53a25658f383ededa42a84db95a99639
SSDEEP 6144:KBy+bnr+Gp0yN90QEY9Kcamcewji45bq3amAZiNQypp0GC5usfuG0YLsDMkRIju1:bMrmy906pamLyiQPFCQypQZfN0YIr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7406082.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7406082.exe
Size 206KB
SHA256 23dc7f0577c50a5e75b4a0486bd142074dfbcbc0f8e255f2df551ee2684abca5
MD5 d2127a0408cee1bdfcbbe560cf8690bc
SHA1 741afd4999abad24b1f7d959ca7a15a8764b5220
SHA512 02d0dbc8e5635a70cfd62cd66fc9c5ebc181c1e29d16bfd892f7e5e85bf259470b3161eecaf02c2b6df35dacba4bc21d6666b04692a0f9d82c3b4ebb0933ba8d
SSDEEP 3072:KZy+bnr+O1/5GWp1icKAArDZz4N9GhbkrNEk1FNyQqfXkEy+uH4WaiWX2V1ob:KZy+bnr+4p0yN90QEEyQqf0QWa64
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7406082.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7406082.exe
Size 206KB
SHA256 23dc7f0577c50a5e75b4a0486bd142074dfbcbc0f8e255f2df551ee2684abca5
MD5 d2127a0408cee1bdfcbbe560cf8690bc
SHA1 741afd4999abad24b1f7d959ca7a15a8764b5220
SHA512 02d0dbc8e5635a70cfd62cd66fc9c5ebc181c1e29d16bfd892f7e5e85bf259470b3161eecaf02c2b6df35dacba4bc21d6666b04692a0f9d82c3b4ebb0933ba8d
SSDEEP 3072:KZy+bnr+O1/5GWp1icKAArDZz4N9GhbkrNEk1FNyQqfXkEy+uH4WaiWX2V1ob:KZy+bnr+4p0yN90QEEyQqf0QWa64
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9716960.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9716960.exe
Size 172KB
SHA256 3b2d0dc9f8aef72af9d09d2454690e045163420b23635652242bc9f61b1d7cf0
MD5 8874eb7032281d9e717b2fab4931581f
SHA1 3c42527d6d06294630c448f92caf6fcd17c81e0b
SHA512 e851eb926f7d17cfbcc3bbb14eedebf24d69858cba208bec7afc963775c86b44b3c69dd430699cb1a6e56226b57bbe7564b54d20d262c37494415a3cb4c56bc2
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9716960.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9716960.exe
Size 172KB
SHA256 3b2d0dc9f8aef72af9d09d2454690e045163420b23635652242bc9f61b1d7cf0
MD5 8874eb7032281d9e717b2fab4931581f
SHA1 3c42527d6d06294630c448f92caf6fcd17c81e0b
SHA512 e851eb926f7d17cfbcc3bbb14eedebf24d69858cba208bec7afc963775c86b44b3c69dd430699cb1a6e56226b57bbe7564b54d20d262c37494415a3cb4c56bc2
SSDEEP 3072:sOPxkahkUcphQF470xNe0QA6AKlhA8e8hU:PPJexvAKlhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1508-157-0x0000000000240000-0x0000000000270000-memory.dmp

Download

memory/1508-158-0x000000000A650000-0x000000000AC68000-memory.dmp

Download

memory/1508-159-0x000000000A1C0000-0x000000000A2CA000-memory.dmp

Download

memory/1508-160-0x000000000A100000-0x000000000A112000-memory.dmp

Download

memory/1508-161-0x000000000A160000-0x000000000A19C000-memory.dmp

Download

memory/1508-162-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/1508-163-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads