redline | 12d16cfc16ce69ad658d507b9cdf105c4f69e15b7ed6e67159ce2d0ca0a348be

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
126478adc317884b0b0a86d76724374f.exe
Size 517KB
Sample230707-3cjkyscc39
SHA256 12d16cfc16ce69ad658d507b9cdf105c4f69e15b7ed6e67159ce2d0ca0a348be
MD5 126478adc317884b0b0a86d76724374f
SHA1 468a9cbe186009f6d78469da2be61d711f5388a2
SHA512 d85f7eab178832a671d281820a8372c29c30a01d7d63d909ac58629c0155712fb81eaba8fb891ccb297757485a0293a0558021b4a4a81d9b3c9b82a70c6fe12b
SSDEEP 12288:NQZefvYaRdnQglSvzGBuARZ73UCA3WjZalenrvVd:NQZEvY82glECR3MUrr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline furod infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

furod

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
444	x5752774.exe
208	f0997188.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	126478adc317884b0b0a86d76724374f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	126478adc317884b0b0a86d76724374f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5752774.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5752774.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 444	2396	126478adc317884b0b0a86d76724374f.exe	86
PID 2396 wrote to memory of 444	2396	126478adc317884b0b0a86d76724374f.exe	86
PID 2396 wrote to memory of 444	2396	126478adc317884b0b0a86d76724374f.exe	86
PID 444 wrote to memory of 208	444	x5752774.exe	87
PID 444 wrote to memory of 208	444	x5752774.exe	87
PID 444 wrote to memory of 208	444	x5752774.exe	87

C:\Users\Admin\AppData\Local\Temp\126478adc317884b0b0a86d76724374f.exe
"C:\Users\Admin\AppData\Local\Temp\126478adc317884b0b0a86d76724374f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5752774.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5752774.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f0997188.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f0997188.exe
    3⤵
    - Executes dropped EXE
    PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5752774.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5752774.exe
Size 331KB
SHA256 e35eabe6c4ef6c2257c1dfadce18b2eefb2c631b472467392ce39465f5f1a0fd
MD5 fae42a66ad2d48ab78780e8bf01b6dd9
SHA1 a2a29ab67da74a943bd2c63fbe812f1934cb0faf
SHA512 1646323401babcf9801cda6386bd69603ee7dd024ad3aad15fe3a951c77906eaa1fe50669e16a28cb35449d171b8c365df43e02c3b539640d84b26487f0bf24a
SSDEEP 6144:Kjy+bnr+6p0yN90QE/FB5KpQ1oPnjYrRFRbOh7j5K/R5w4gGX:JMr6y90TB5WHSRXy9j65j
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5752774.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5752774.exe
Size 331KB
SHA256 e35eabe6c4ef6c2257c1dfadce18b2eefb2c631b472467392ce39465f5f1a0fd
MD5 fae42a66ad2d48ab78780e8bf01b6dd9
SHA1 a2a29ab67da74a943bd2c63fbe812f1934cb0faf
SHA512 1646323401babcf9801cda6386bd69603ee7dd024ad3aad15fe3a951c77906eaa1fe50669e16a28cb35449d171b8c365df43e02c3b539640d84b26487f0bf24a
SSDEEP 6144:Kjy+bnr+6p0yN90QE/FB5KpQ1oPnjYrRFRbOh7j5K/R5w4gGX:JMr6y90TB5WHSRXy9j65j
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0997188.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f0997188.exe
Size 257KB
SHA256 472930d32e6233deeb0ad4a9a47598a83023b7d7a8e3929e09bc2d77820c3625
MD5 298bca8002694092a5865efa72dae277
SHA1 a75b529d86c7be9a5d7423f7cbc1d3a4301b159b
SHA512 f3ee692c0830185ff4bc8736c1455646ef44884e7078228a230a7c22b4d8cfd73d50f796730e8aad7eb73f6a445c6b70cffa7cb8cb8502a4fcf0d42ad529f921
SSDEEP 6144:j4MO4Tp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIeH:j4MOMIYR0vfjZZ92hUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0997188.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f0997188.exe
Size 257KB
SHA256 472930d32e6233deeb0ad4a9a47598a83023b7d7a8e3929e09bc2d77820c3625
MD5 298bca8002694092a5865efa72dae277
SHA1 a75b529d86c7be9a5d7423f7cbc1d3a4301b159b
SHA512 f3ee692c0830185ff4bc8736c1455646ef44884e7078228a230a7c22b4d8cfd73d50f796730e8aad7eb73f6a445c6b70cffa7cb8cb8502a4fcf0d42ad529f921
SSDEEP 6144:j4MO4Tp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIeH:j4MOMIYR0vfjZZ92hUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-153-0x00000000005A0000-0x00000000005D0000-memory.dmp

Download

memory/208-157-0x0000000005220000-0x0000000005838000-memory.dmp

Download

memory/208-158-0x0000000004C00000-0x0000000004D0A000-memory.dmp

Download

memory/208-159-0x0000000004D20000-0x0000000004D32000-memory.dmp

Download

memory/208-160-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Download

memory/208-161-0x0000000004D40000-0x0000000004D7C000-memory.dmp

Download

memory/208-162-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Download

memory/2396-133-0x0000000000800000-0x0000000000871000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads