redline | c4b174e1bd5f31fef14168c84edf47fc4a4f148782aa6df9edc39bc1527a1a0d

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 784KB
Sample230615-2dmtbsbd9y
SHA256 c4b174e1bd5f31fef14168c84edf47fc4a4f148782aa6df9edc39bc1527a1a0d
MD5 3d398eb43a615150145d2c154821ad65
SHA1 d4f55773e869481e05725b0243b65f4258f78836
SHA512 73c75dc44424eceaef1954054f5a062c26ae79389a6747dac5d78b1242321b5750c62c02657614dcd8dbd8c0aa957dd74d1b8504cf65087deb094bd7567ad81d
SSDEEP 12288:VMrwy90RR9dTWWbevx1sDfHxbv/88h583n5IS+OBucqKwO64AlKRZMGb:JyM1WhkjxbslIYoIvAARZj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline joker infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

joker

83.97.73.130:19061

Attributes

auth_value
a98d303cc28bb3b32a23c59214ae3bc0

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4552	v5641821.exe
3364	v6194184.exe
608	v9502040.exe
544	a7220743.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6194184.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v9502040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9502040.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v5641821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5641821.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	v6194184.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4552	4928	file.exe	85
PID 4928 wrote to memory of 4552	4928	file.exe	85
PID 4928 wrote to memory of 4552	4928	file.exe	85
PID 4552 wrote to memory of 3364	4552	v5641821.exe	86
PID 4552 wrote to memory of 3364	4552	v5641821.exe	86
PID 4552 wrote to memory of 3364	4552	v5641821.exe	86
PID 3364 wrote to memory of 608	3364	v6194184.exe	87
PID 3364 wrote to memory of 608	3364	v6194184.exe	87
PID 3364 wrote to memory of 608	3364	v6194184.exe	87
PID 608 wrote to memory of 544	608	v9502040.exe	88
PID 608 wrote to memory of 544	608	v9502040.exe	88
PID 608 wrote to memory of 544	608	v9502040.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5641821.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5641821.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6194184.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6194184.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9502040.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9502040.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:608
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7220743.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7220743.exe
        5⤵
        Executes dropped EXE
        
        PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v5641821.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5641821.exe
Size 587KB
SHA256 ac321b596c096e66b03f9b41a3355ad296b4b09d0ad24916af8c28bf724a6aa2
MD5 85c9c13afea6a71a77381880862ce01c
SHA1 4379fd1e5c38dece99de75275af360646d992ee7
SHA512 3a89908d08caaccd9d8c7f7b5e1fa3fd924f65c2e68c0b0c8a8601afde5d1921a635feddf717ae2063a4529f67d525ddad669074042cd780b6c82f3f23f969fc
SSDEEP 12288:PMrDy90zLdcbz2wB/rHobv/8SgxNXXx6SzOjpRyptHj6KkB64Ha:AyMcX2wJobsfxF0XHyptHj6zvHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

v5641821.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5641821.exe
Size 587KB
SHA256 ac321b596c096e66b03f9b41a3355ad296b4b09d0ad24916af8c28bf724a6aa2
MD5 85c9c13afea6a71a77381880862ce01c
SHA1 4379fd1e5c38dece99de75275af360646d992ee7
SHA512 3a89908d08caaccd9d8c7f7b5e1fa3fd924f65c2e68c0b0c8a8601afde5d1921a635feddf717ae2063a4529f67d525ddad669074042cd780b6c82f3f23f969fc
SSDEEP 12288:PMrDy90zLdcbz2wB/rHobv/8SgxNXXx6SzOjpRyptHj6KkB64Ha:AyMcX2wJobsfxF0XHyptHj6zvHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6194184.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6194184.exe
Size 415KB
SHA256 db2c19824a7c53772df4a7ef3f896658845cd3f481a9bbf8bd51084eb880a2cf
MD5 346ec8eea1c4e0bddccaddea30e016ee
SHA1 7714dd353d3a02e400c12a6a2a3ba2e30cf70906
SHA512 896ce30091de827604179a242476fd01183e1f03db2137cef78d293f162a2ab13f9c69f8ff06c1f526cfb61d8daca3592b8c735698e7fbb6f83bb596393f889e
SSDEEP 6144:Kmy+bnr+Gp0yN90QEbkqkREybnv6E80dz6S+YbUy4t64bx3SRsaZptHR:uMr+y90bkREeOO6SHOtqRlptHR
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6194184.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6194184.exe
Size 415KB
SHA256 db2c19824a7c53772df4a7ef3f896658845cd3f481a9bbf8bd51084eb880a2cf
MD5 346ec8eea1c4e0bddccaddea30e016ee
SHA1 7714dd353d3a02e400c12a6a2a3ba2e30cf70906
SHA512 896ce30091de827604179a242476fd01183e1f03db2137cef78d293f162a2ab13f9c69f8ff06c1f526cfb61d8daca3592b8c735698e7fbb6f83bb596393f889e
SSDEEP 6144:Kmy+bnr+Gp0yN90QEbkqkREybnv6E80dz6S+YbUy4t64bx3SRsaZptHR:uMr+y90bkREeOO6SHOtqRlptHR
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9502040.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9502040.exe
Size 260KB
SHA256 992738102992004a03d6f585f765f26f2bb89235193ccc3fa345c2c72b4e079b
MD5 96cbd07437c33ed45375e93bd965d83a
SHA1 06cdd1beb37c38f5e7216945e9482312b06a5090
SHA512 ab2c0c89dae783be1d12b7707fa93fed83759cdcf9e1b68c5031d121c5553c697bf3925562be7e56ad930887678859efff9c045607e849effa9febfd15db07b7
SSDEEP 6144:KHy+bnr+Xp0yN90QEHLKslPMFymOqsUyVt64Xj:NMrLy905plPM0tPt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9502040.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9502040.exe
Size 260KB
SHA256 992738102992004a03d6f585f765f26f2bb89235193ccc3fa345c2c72b4e079b
MD5 96cbd07437c33ed45375e93bd965d83a
SHA1 06cdd1beb37c38f5e7216945e9482312b06a5090
SHA512 ab2c0c89dae783be1d12b7707fa93fed83759cdcf9e1b68c5031d121c5553c697bf3925562be7e56ad930887678859efff9c045607e849effa9febfd15db07b7
SSDEEP 6144:KHy+bnr+Xp0yN90QEHLKslPMFymOqsUyVt64Xj:NMrLy905plPM0tPt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7220743.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7220743.exe
Size 255KB
SHA256 c2760ab79b3902ad273fc95b9ad7dd99255523756a89fba6dcd0bfa943905c82
MD5 6a18bdcaa5c23e7d908278e32c5155ba
SHA1 41a3adc1c408c07a5839db0fb7403525aa768d88
SHA512 e25526ffe3552e7b1edf4af2e3e6bacc350890923ebee7184a272b089df943aba41d0ffa8dbb2d7834040b1a2e8e4f6ed32c0633b86c61ae5748862700b1839b
SSDEEP 6144:0Uc2Dr0TZC4xR4aPYaD4hYhJWJSW/Ve3:xcw0TZCO4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7220743.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7220743.exe
Size 255KB
SHA256 c2760ab79b3902ad273fc95b9ad7dd99255523756a89fba6dcd0bfa943905c82
MD5 6a18bdcaa5c23e7d908278e32c5155ba
SHA1 41a3adc1c408c07a5839db0fb7403525aa768d88
SHA512 e25526ffe3552e7b1edf4af2e3e6bacc350890923ebee7184a272b089df943aba41d0ffa8dbb2d7834040b1a2e8e4f6ed32c0633b86c61ae5748862700b1839b
SSDEEP 6144:0Uc2Dr0TZC4xR4aPYaD4hYhJWJSW/Ve3:xcw0TZCO4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7220743.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7220743.exe
Size 255KB
SHA256 c2760ab79b3902ad273fc95b9ad7dd99255523756a89fba6dcd0bfa943905c82
MD5 6a18bdcaa5c23e7d908278e32c5155ba
SHA1 41a3adc1c408c07a5839db0fb7403525aa768d88
SHA512 e25526ffe3552e7b1edf4af2e3e6bacc350890923ebee7184a272b089df943aba41d0ffa8dbb2d7834040b1a2e8e4f6ed32c0633b86c61ae5748862700b1839b
SSDEEP 6144:0Uc2Dr0TZC4xR4aPYaD4hYhJWJSW/Ve3:xcw0TZCO4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-161-0x0000000000440000-0x0000000000470000-memory.dmp

Download

memory/544-165-0x0000000004BF0000-0x0000000005208000-memory.dmp

Download

memory/544-166-0x0000000005210000-0x000000000531A000-memory.dmp

Download

memory/544-167-0x0000000005330000-0x0000000005342000-memory.dmp

Download

memory/544-168-0x0000000005350000-0x000000000538C000-memory.dmp

Download

memory/544-169-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Download

memory/544-170-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads