redline | a4fa3675a5bb1ff4d55d4901226d7be7aafe780eb70d5bdb459de32d4bf77c21

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 578KB
Sample230607-bphqmsgc67
SHA256 a4fa3675a5bb1ff4d55d4901226d7be7aafe780eb70d5bdb459de32d4bf77c21
MD5 a9e24708edff0275d3d61abed4af2f16
SHA1 4d03d2c24454b0bac95f73109b71ea3603a833b3
SHA512 9b5ba4efa8ae049816b2c7b0febe26022bafcec5784d8c2b612cad202a4ea4f8190602a232422244957bc5f883944701214139dae482943611d71d50fc7b4487
SSDEEP 12288:/MrUy90lZ+DHJDFx+fbcmMd6TdD9Urw+sLsTaSce3SbrPms:PyhDpqjdDX+sgcTT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dasa discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

dasa

83.97.73.126:19048

Attributes

auth_value
7eca6ed540c2dcd359aed5b67c4eda07

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4488	x3176525.exe
3208	x6318444.exe
1152	f2830120.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3176525.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3176525.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6318444.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6318444.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe
1152	f2830120.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	f2830120.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4488	3516	file.exe	85
PID 3516 wrote to memory of 4488	3516	file.exe	85
PID 3516 wrote to memory of 4488	3516	file.exe	85
PID 4488 wrote to memory of 3208	4488	x3176525.exe	86
PID 4488 wrote to memory of 3208	4488	x3176525.exe	86
PID 4488 wrote to memory of 3208	4488	x3176525.exe	86
PID 3208 wrote to memory of 1152	3208	x6318444.exe	87
PID 3208 wrote to memory of 1152	3208	x6318444.exe	87
PID 3208 wrote to memory of 1152	3208	x6318444.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3176525.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3176525.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6318444.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6318444.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2830120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2830120.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x3176525.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3176525.exe
Size 378KB
SHA256 c82e235986266d11dc1c3e92ed40b0d1314efb133150d8a4bc447cc7d7e4e837
MD5 e2a97ce65dec2b43f540c59bd960f671
SHA1 7520966161c4c1236918f917e2f57e665f395c79
SHA512 bdaca0c3f2d5f357e4a9661d85dd4d98757d19ef55d0a8049f1a719e65aece1f4a31b698e1b56a53629ac3addded7db22596fe92d4454e437c9954964605646b
SSDEEP 6144:Kay+bnr+mp0yN90QEzDs6+8rnYnepE2ymI0EvrjidTdDpuUrwfOz8Asx:KMryy90Nx+0YpmIdqTdDcUrwOsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3176525.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3176525.exe
Size 378KB
SHA256 c82e235986266d11dc1c3e92ed40b0d1314efb133150d8a4bc447cc7d7e4e837
MD5 e2a97ce65dec2b43f540c59bd960f671
SHA1 7520966161c4c1236918f917e2f57e665f395c79
SHA512 bdaca0c3f2d5f357e4a9661d85dd4d98757d19ef55d0a8049f1a719e65aece1f4a31b698e1b56a53629ac3addded7db22596fe92d4454e437c9954964605646b
SSDEEP 6144:Kay+bnr+mp0yN90QEzDs6+8rnYnepE2ymI0EvrjidTdDpuUrwfOz8Asx:KMryy90Nx+0YpmIdqTdDcUrwOsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6318444.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6318444.exe
Size 206KB
SHA256 0080ed630d8735bc2e2b6bfbff64c5f204d116490ec24913bafdc2d24df561f4
MD5 36bd932f4cbd7f591d92521921f80928
SHA1 c2c298116d6f44298eb7be42c5f7a27445c2838b
SHA512 17460a5750f36c8bbfa807771a7d6d796f698787d93d039effc7893d14456b06a22c3dffa58b889e7ed5ab1476e98f2155ab189c050b4ee346472c78d900f1e8
SSDEEP 3072:Kmy+bnr+O1Fh5GWp1icKAArDZz4N9GhbkrNEk1bpLDlwxj8FAJR988WhQoz:Kmy+bnr+SXp0yN90QEQGxj1/Wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6318444.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6318444.exe
Size 206KB
SHA256 0080ed630d8735bc2e2b6bfbff64c5f204d116490ec24913bafdc2d24df561f4
MD5 36bd932f4cbd7f591d92521921f80928
SHA1 c2c298116d6f44298eb7be42c5f7a27445c2838b
SHA512 17460a5750f36c8bbfa807771a7d6d796f698787d93d039effc7893d14456b06a22c3dffa58b889e7ed5ab1476e98f2155ab189c050b4ee346472c78d900f1e8
SSDEEP 3072:Kmy+bnr+O1Fh5GWp1icKAArDZz4N9GhbkrNEk1bpLDlwxj8FAJR988WhQoz:Kmy+bnr+SXp0yN90QEQGxj1/Wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2830120.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2830120.exe
Size 172KB
SHA256 8412bd693bd3a6df5aa0c6cbf9b87f317d752225eb788893396a82e986d0f7fd
MD5 30c268561b2eb63eb3d4622b872b67bf
SHA1 0c31852fbd15317677059f19096555568bda3af5
SHA512 c9d7afb9141641cc0047b41629e72d144007cd3916839a9ca173a80b2d3e8b472f97f6fc66efecac938f897e5aea931d42f3bdae8dbb102564d3ed47d6cc21bc
SSDEEP 3072:cRz1DYPqR5WAAq2xhxN78o51Vb08e8hJ:czxRIT1xhb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2830120.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f2830120.exe
Size 172KB
SHA256 8412bd693bd3a6df5aa0c6cbf9b87f317d752225eb788893396a82e986d0f7fd
MD5 30c268561b2eb63eb3d4622b872b67bf
SHA1 0c31852fbd15317677059f19096555568bda3af5
SHA512 c9d7afb9141641cc0047b41629e72d144007cd3916839a9ca173a80b2d3e8b472f97f6fc66efecac938f897e5aea931d42f3bdae8dbb102564d3ed47d6cc21bc
SSDEEP 3072:cRz1DYPqR5WAAq2xhxN78o51Vb08e8hJ:czxRIT1xhb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1152-158-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Download

memory/1152-161-0x00000000055D0000-0x0000000005662000-memory.dmp

Download

memory/1152-156-0x0000000005200000-0x000000000530A000-memory.dmp

Download

memory/1152-157-0x0000000005140000-0x0000000005152000-memory.dmp

Download

memory/1152-154-0x00000000006A0000-0x00000000006D0000-memory.dmp

Download

memory/1152-159-0x00000000051A0000-0x00000000051DC000-memory.dmp

Download

memory/1152-160-0x00000000054B0000-0x0000000005526000-memory.dmp

Download

memory/1152-155-0x0000000005700000-0x0000000005D18000-memory.dmp

Download

memory/1152-162-0x00000000067C0000-0x0000000006D64000-memory.dmp

Download

memory/1152-163-0x0000000005670000-0x00000000056D6000-memory.dmp

Download

memory/1152-164-0x0000000006410000-0x0000000006460000-memory.dmp

Download

memory/1152-165-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Download

memory/1152-166-0x0000000006D70000-0x0000000006F32000-memory.dmp

Download

memory/1152-167-0x0000000008990000-0x0000000008EBC000-memory.dmp

Download