redline | 29a1daaca503d16f25e0a53fee4ef48f4718fa63ed0f8e141561cf3bec355cef

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2023, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d0d937971e713724355e77e8d912dfc.exe
Size 604KB
Sample230613-284ekacd6t
SHA256 29a1daaca503d16f25e0a53fee4ef48f4718fa63ed0f8e141561cf3bec355cef
MD5 6d0d937971e713724355e77e8d912dfc
SHA1 ee2b8e4ba638e7bb5f4aaf1ba0c857e893706bd5
SHA512 bbdd26cdcb0e93bf47cdd0e72a6023b1daa49ae6c74b93a904b8700004d1104f7b58713d1981d0a728713a4317dbeb7acc5078f4110cfb8c995971af547918f1
SSDEEP 12288:MMrHy90rrrde2sBiuOzPuZkA1htx14v+RLocx0gmANOIEpEN3a:byMs2FzGZkWmvGss0NAAIET
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline diza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

diza

83.97.73.130:19061

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
232	x5649992.exe
4608	x3342428.exe
4072	f6695266.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5649992.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3342428.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3342428.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6d0d937971e713724355e77e8d912dfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6d0d937971e713724355e77e8d912dfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5649992.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 232	2084	6d0d937971e713724355e77e8d912dfc.exe	83
PID 2084 wrote to memory of 232	2084	6d0d937971e713724355e77e8d912dfc.exe	83
PID 2084 wrote to memory of 232	2084	6d0d937971e713724355e77e8d912dfc.exe	83
PID 232 wrote to memory of 4608	232	x5649992.exe	84
PID 232 wrote to memory of 4608	232	x5649992.exe	84
PID 232 wrote to memory of 4608	232	x5649992.exe	84
PID 4608 wrote to memory of 4072	4608	x3342428.exe	85
PID 4608 wrote to memory of 4072	4608	x3342428.exe	85
PID 4608 wrote to memory of 4072	4608	x3342428.exe	85

C:\Users\Admin\AppData\Local\Temp\6d0d937971e713724355e77e8d912dfc.exe
"C:\Users\Admin\AppData\Local\Temp\6d0d937971e713724355e77e8d912dfc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5649992.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5649992.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3342428.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3342428.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6695266.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6695266.exe
      4⤵
      Executes dropped EXE
      PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5649992.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5649992.exe
Size 377KB
SHA256 774ff0a9dd39773ace3e3e299a8b9a9f5ef9c138f1dbb7726e058456904d9008
MD5 4420d078de10d00a6c2863c6356d8dd7
SHA1 3c0df6304fa1ceab85d31ac1ce89c28546945a30
SHA512 ea4ce4d8ebbb27ede6c52345fc8f56895a93dda05765d31cf7e0a42649a5239291b9cfb8b88d8784fba30fe8a944b11a1b44f6cb7dbf6112dfcc8834101b7439
SSDEEP 6144:KMy+bnr+Gp0yN90QEyMmKFjk/VunMxSM/EmzqSorvR3ZGCMhB+JhtvpKxquGXA3:EMruy90kG+YMM9tZGdYhtxFva
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5649992.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5649992.exe
Size 377KB
SHA256 774ff0a9dd39773ace3e3e299a8b9a9f5ef9c138f1dbb7726e058456904d9008
MD5 4420d078de10d00a6c2863c6356d8dd7
SHA1 3c0df6304fa1ceab85d31ac1ce89c28546945a30
SHA512 ea4ce4d8ebbb27ede6c52345fc8f56895a93dda05765d31cf7e0a42649a5239291b9cfb8b88d8784fba30fe8a944b11a1b44f6cb7dbf6112dfcc8834101b7439
SSDEEP 6144:KMy+bnr+Gp0yN90QEyMmKFjk/VunMxSM/EmzqSorvR3ZGCMhB+JhtvpKxquGXA3:EMruy90kG+YMM9tZGdYhtxFva
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3342428.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3342428.exe
Size 206KB
SHA256 5a09b6263c382cae1b7f6195bc9094203a97a0a54775cde0414436ccb39933dd
MD5 2945b67667c43044b6f9f6348a5dc8b0
SHA1 eebe2c6617bfd7a788c539b208551f770cab41ab
SHA512 9550f8cbd225c83cbcb56350448893760bb1f7fda7fa98fa73bf0f2400f28d2819e78baf1248a8b45013d3e595dd491aa4572b3b703626117478d697d5cf0744
SSDEEP 3072:Kzy+bnr+O1j5GWp1icKAArDZz4N9GhbkrNEk1dKfx/QILgqvLDcnnn2R6ox:Kzy+bnr+Mp0yN90QEuKssLmnW
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3342428.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3342428.exe
Size 206KB
SHA256 5a09b6263c382cae1b7f6195bc9094203a97a0a54775cde0414436ccb39933dd
MD5 2945b67667c43044b6f9f6348a5dc8b0
SHA1 eebe2c6617bfd7a788c539b208551f770cab41ab
SHA512 9550f8cbd225c83cbcb56350448893760bb1f7fda7fa98fa73bf0f2400f28d2819e78baf1248a8b45013d3e595dd491aa4572b3b703626117478d697d5cf0744
SSDEEP 3072:Kzy+bnr+O1j5GWp1icKAArDZz4N9GhbkrNEk1dKfx/QILgqvLDcnnn2R6ox:Kzy+bnr+Mp0yN90QEuKssLmnW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6695266.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6695266.exe
Size 172KB
SHA256 b33392e15e948d10f2df35735bd3f8f875cb68eaed2dc1d69fb569fc5eeec95e
MD5 92f30278cbbd283806ef80b6b47f858a
SHA1 b1cc5bfe5ce6c7c7847e8f04e6591364858d310b
SHA512 77ff50b6a7f3e913e9b5a1fc57121e162b8f156ae05ee848bcb9bbd92c0557ec35f65757be1c5003286118fee8c9cba2d16206ff70cd508f979c00b0367e8466
SSDEEP 3072:PZ+q6hVbwIxxiIDg8qAxNKcbMhQ4k9o8e8hi:PZ+q6P7ihjB654k9o
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6695266.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6695266.exe
Size 172KB
SHA256 b33392e15e948d10f2df35735bd3f8f875cb68eaed2dc1d69fb569fc5eeec95e
MD5 92f30278cbbd283806ef80b6b47f858a
SHA1 b1cc5bfe5ce6c7c7847e8f04e6591364858d310b
SHA512 77ff50b6a7f3e913e9b5a1fc57121e162b8f156ae05ee848bcb9bbd92c0557ec35f65757be1c5003286118fee8c9cba2d16206ff70cd508f979c00b0367e8466
SSDEEP 3072:PZ+q6hVbwIxxiIDg8qAxNKcbMhQ4k9o8e8hi:PZ+q6P7ihjB654k9o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4072-154-0x00000000005A0000-0x00000000005D0000-memory.dmp

Download

memory/4072-155-0x000000000A860000-0x000000000AE78000-memory.dmp

Download

memory/4072-156-0x000000000A3E0000-0x000000000A4EA000-memory.dmp

Download

memory/4072-157-0x000000000A320000-0x000000000A332000-memory.dmp

Download

memory/4072-158-0x0000000002840000-0x0000000002850000-memory.dmp

Download

memory/4072-159-0x000000000A380000-0x000000000A3BC000-memory.dmp

Download

memory/4072-160-0x0000000002840000-0x0000000002850000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads