redline | a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe
Size 572KB
Sample230703-qdr79shh21
SHA256 a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a
MD5 12564dba5b3178c75a6a96a582f94c5b
SHA1 003817ee6dac145edf947b062bc9b25653d32613
SHA512 5402ce66c56b8612887a1f28e1f5bf695867b1993d61b8d2d03c01d8c01fb1f270b101e85358c65ed27fc7f037f780b1290cac010c107f8339e3393e3157e5b9
SSDEEP 12288:PMrcy90ic73VvlgFq5RMdM3pxSu2TaQIXpQSIimiD:3ynitggNZI3KdIx8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline duza infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

duza

83.97.73.129:19071

Attributes

auth_value
787a4e3bbc78fd525526de1098cb0621

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2020	x5268627.exe
1076	x3887218.exe
1008	f5282036.exe

Loads dropped DLL 6 IoCs

pid	Process
600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe
2020	x5268627.exe
2020	x5268627.exe
1076	x3887218.exe
1076	x3887218.exe
1008	f5282036.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5268627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5268627.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3887218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3887218.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 600 wrote to memory of 2020	600	a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe	26
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 2020 wrote to memory of 1076	2020	x5268627.exe	27
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28
PID 1076 wrote to memory of 1008	1076	x3887218.exe	28

C:\Users\Admin\AppData\Local\Temp\a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe
"C:\Users\Admin\AppData\Local\Temp\a299032783c88dab7cdf4b36b26ee3caf35b9b629e8140cdbb022ab7eabf151a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5268627.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
Size 471KB
SHA256 bc98d50724270445861a310c2a15ffec6f1f2d5cbe72e3114757394920bae858
MD5 7c2022b431992b87c9bfe56acd958b2d
SHA1 2251d216822746bfdfb08845860f2ba964212301
SHA512 e9f8e2575a88cb669369fc0268e5d695a1e0e2778b8940fcc66b854150f71aa61d907948e545d3701036b13237f68d1bdb563e372c1c2e4d5891525c99e9a427
SSDEEP 12288:PMrXy90XvlbFqFKMSI3pIOugTNQ+aMQSIvmt:QyQtbUtZniIdIOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5268627.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
Size 471KB
SHA256 bc98d50724270445861a310c2a15ffec6f1f2d5cbe72e3114757394920bae858
MD5 7c2022b431992b87c9bfe56acd958b2d
SHA1 2251d216822746bfdfb08845860f2ba964212301
SHA512 e9f8e2575a88cb669369fc0268e5d695a1e0e2778b8940fcc66b854150f71aa61d907948e545d3701036b13237f68d1bdb563e372c1c2e4d5891525c99e9a427
SSDEEP 12288:PMrXy90XvlbFqFKMSI3pIOugTNQ+aMQSIvmt:QyQtbUtZniIdIOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3887218.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
Size 277KB
SHA256 56fbf1992e5615f8894f56738ed59770882115b07b77bee4ff0f16388f80f86c
MD5 a4abe97444471186b3406386fd6c7d2f
SHA1 f0ba26aabd9d72f31d96a05ef7978245c34c34aa
SHA512 746ec9f0a931371889ec09d8997287d2c9b2aec7844ba536037d9f6bcec575f6e05e3e1e62e8219969e91456d4f4042713a24016b89e020e13267fa74ee62762
SSDEEP 6144:Kdy+bnr+Jp0yN90QES9XuT4z+WBdbRUxkKagpuFvXrrGT+FxLN7j:7Mr1y90D+7dbRYn3pGOTqd
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3887218.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
Size 277KB
SHA256 56fbf1992e5615f8894f56738ed59770882115b07b77bee4ff0f16388f80f86c
MD5 a4abe97444471186b3406386fd6c7d2f
SHA1 f0ba26aabd9d72f31d96a05ef7978245c34c34aa
SHA512 746ec9f0a931371889ec09d8997287d2c9b2aec7844ba536037d9f6bcec575f6e05e3e1e62e8219969e91456d4f4042713a24016b89e020e13267fa74ee62762
SSDEEP 6144:Kdy+bnr+Jp0yN90QES9XuT4z+WBdbRUxkKagpuFvXrrGT+FxLN7j:7Mr1y90D+7dbRYn3pGOTqd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5282036.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
Size 173KB
SHA256 aac3a769d9afeb55271d1e03ccb5d75bcabf125c2acd238f6993096d6382633c
MD5 a8a80fd5138a0bada9ae3f72f8daf7af
SHA1 bbf4b9f3bc0099bea935f3fd1387bb524ab94b6b
SHA512 af6f1949f52d7ddaee3a46b6d23550d47756d448ab80666699b4cb8e103382c4133cd015316d9d05f9591907d1a429a0a04007fa0ea1d36b4a46bf1b2c81d74a
SSDEEP 3072:HWKe1kiJtebRavRJxNv4nFkbgWoHn8e8hI:HWcUt1RZbgWoHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5282036.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
Size 173KB
SHA256 aac3a769d9afeb55271d1e03ccb5d75bcabf125c2acd238f6993096d6382633c
MD5 a8a80fd5138a0bada9ae3f72f8daf7af
SHA1 bbf4b9f3bc0099bea935f3fd1387bb524ab94b6b
SHA512 af6f1949f52d7ddaee3a46b6d23550d47756d448ab80666699b4cb8e103382c4133cd015316d9d05f9591907d1a429a0a04007fa0ea1d36b4a46bf1b2c81d74a
SSDEEP 3072:HWKe1kiJtebRavRJxNv4nFkbgWoHn8e8hI:HWcUt1RZbgWoHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5268627.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
Size 471KB
SHA256 bc98d50724270445861a310c2a15ffec6f1f2d5cbe72e3114757394920bae858
MD5 7c2022b431992b87c9bfe56acd958b2d
SHA1 2251d216822746bfdfb08845860f2ba964212301
SHA512 e9f8e2575a88cb669369fc0268e5d695a1e0e2778b8940fcc66b854150f71aa61d907948e545d3701036b13237f68d1bdb563e372c1c2e4d5891525c99e9a427
SSDEEP 12288:PMrXy90XvlbFqFKMSI3pIOugTNQ+aMQSIvmt:QyQtbUtZniIdIOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5268627.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5268627.exe
Size 471KB
SHA256 bc98d50724270445861a310c2a15ffec6f1f2d5cbe72e3114757394920bae858
MD5 7c2022b431992b87c9bfe56acd958b2d
SHA1 2251d216822746bfdfb08845860f2ba964212301
SHA512 e9f8e2575a88cb669369fc0268e5d695a1e0e2778b8940fcc66b854150f71aa61d907948e545d3701036b13237f68d1bdb563e372c1c2e4d5891525c99e9a427
SSDEEP 12288:PMrXy90XvlbFqFKMSI3pIOugTNQ+aMQSIvmt:QyQtbUtZniIdIOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3887218.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
Size 277KB
SHA256 56fbf1992e5615f8894f56738ed59770882115b07b77bee4ff0f16388f80f86c
MD5 a4abe97444471186b3406386fd6c7d2f
SHA1 f0ba26aabd9d72f31d96a05ef7978245c34c34aa
SHA512 746ec9f0a931371889ec09d8997287d2c9b2aec7844ba536037d9f6bcec575f6e05e3e1e62e8219969e91456d4f4042713a24016b89e020e13267fa74ee62762
SSDEEP 6144:Kdy+bnr+Jp0yN90QES9XuT4z+WBdbRUxkKagpuFvXrrGT+FxLN7j:7Mr1y90D+7dbRYn3pGOTqd
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3887218.exe

Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\x3887218.exe
Size 277KB
SHA256 56fbf1992e5615f8894f56738ed59770882115b07b77bee4ff0f16388f80f86c
MD5 a4abe97444471186b3406386fd6c7d2f
SHA1 f0ba26aabd9d72f31d96a05ef7978245c34c34aa
SHA512 746ec9f0a931371889ec09d8997287d2c9b2aec7844ba536037d9f6bcec575f6e05e3e1e62e8219969e91456d4f4042713a24016b89e020e13267fa74ee62762
SSDEEP 6144:Kdy+bnr+Jp0yN90QES9XuT4z+WBdbRUxkKagpuFvXrrGT+FxLN7j:7Mr1y90D+7dbRYn3pGOTqd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5282036.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
Size 173KB
SHA256 aac3a769d9afeb55271d1e03ccb5d75bcabf125c2acd238f6993096d6382633c
MD5 a8a80fd5138a0bada9ae3f72f8daf7af
SHA1 bbf4b9f3bc0099bea935f3fd1387bb524ab94b6b
SHA512 af6f1949f52d7ddaee3a46b6d23550d47756d448ab80666699b4cb8e103382c4133cd015316d9d05f9591907d1a429a0a04007fa0ea1d36b4a46bf1b2c81d74a
SSDEEP 3072:HWKe1kiJtebRavRJxNv4nFkbgWoHn8e8hI:HWcUt1RZbgWoHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5282036.exe

Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\f5282036.exe
Size 173KB
SHA256 aac3a769d9afeb55271d1e03ccb5d75bcabf125c2acd238f6993096d6382633c
MD5 a8a80fd5138a0bada9ae3f72f8daf7af
SHA1 bbf4b9f3bc0099bea935f3fd1387bb524ab94b6b
SHA512 af6f1949f52d7ddaee3a46b6d23550d47756d448ab80666699b4cb8e103382c4133cd015316d9d05f9591907d1a429a0a04007fa0ea1d36b4a46bf1b2c81d74a
SSDEEP 3072:HWKe1kiJtebRavRJxNv4nFkbgWoHn8e8hI:HWcUt1RZbgWoHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1008-84-0x0000000000BC0000-0x0000000000BF0000-memory.dmp

Download

memory/1008-85-0x0000000000340000-0x0000000000346000-memory.dmp

Download

memory/1008-86-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Download

memory/1008-87-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads