redline | ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042cdc32e0cfe1695aec9e

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe
Size 518KB
Sample230707-we54eabd4t
SHA256 ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042cdc32e0cfe1695aec9e
MD5 b5242b085b08afd4ef7b77b26c4149b0
SHA1 0b490c0223332b10b662766117f1fa855730c62d
SHA512 3b46aab4c8ab13ca665da83cb510716cd34396d8552621c0aa00c5e120af41c4488f07e38d58c3b8447f22cf1b1ca37980423ac9b6a90b502fb3e47a1ab5c2ac
SSDEEP 12288:YpIEfvDaRdnQgaW72c2bN5Yy1IqocMXqaaMqUoxKIi3Z:YpIOvD82gaed2bN5YqoLXq6kKIaZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline furod infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

furod

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
2588	x6332898.exe
4024	f1098318.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6332898.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6332898.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2588	4636	ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe	85
PID 4636 wrote to memory of 2588	4636	ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe	85
PID 4636 wrote to memory of 2588	4636	ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe	85
PID 2588 wrote to memory of 4024	2588	x6332898.exe	87
PID 2588 wrote to memory of 4024	2588	x6332898.exe	87
PID 2588 wrote to memory of 4024	2588	x6332898.exe	87

C:\Users\Admin\AppData\Local\Temp\ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe
"C:\Users\Admin\AppData\Local\Temp\ca3c8713631c01dcb9f7bf4fe2851309f0ca53c479042.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6332898.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6332898.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1098318.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1098318.exe
    3⤵
    - Executes dropped EXE
    PID:4024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x6332898.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6332898.exe
Size 331KB
SHA256 1f646acfdf192b28c899bc2e301b5ff0505ea31d7d61516d5d6261a8866e152b
MD5 87cd2877ee11cb1e0d539671379d4161
SHA1 d4ed7c81c23245711a762408c6468ffde11b1264
SHA512 574c8352415e94bac2ccabeac03c23b49825f11a1711756cfaef256b556dc4de42ad7c90ee01e845747826e0205cd35947e496f9d0935877c88ecbbd381ba4d0
SSDEEP 6144:KFy+bnr+ep0yN90QEh+TwTC0QNP47L7qXf6yYTwP3fAy072pnER:/Mruy90mTDP47L7qP6yYTwf4inER
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6332898.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6332898.exe
Size 331KB
SHA256 1f646acfdf192b28c899bc2e301b5ff0505ea31d7d61516d5d6261a8866e152b
MD5 87cd2877ee11cb1e0d539671379d4161
SHA1 d4ed7c81c23245711a762408c6468ffde11b1264
SHA512 574c8352415e94bac2ccabeac03c23b49825f11a1711756cfaef256b556dc4de42ad7c90ee01e845747826e0205cd35947e496f9d0935877c88ecbbd381ba4d0
SSDEEP 6144:KFy+bnr+ep0yN90QEh+TwTC0QNP47L7qXf6yYTwP3fAy072pnER:/Mruy90mTDP47L7qP6yYTwf4inER
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1098318.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1098318.exe
Size 257KB
SHA256 7257939a69968858a56fbc2b7ceb0a0a90f2936d6fa1e03d45d820ac604d3ad6
MD5 dce347045d9509df1fedb318c1ccd4db
SHA1 6216c56ae94d6fb3761ea1dffb09511d0c9659db
SHA512 9a9d098ab62b85241af02e3e00d4b59e1e7106057926485c03ad1dd52d08976768093f70bde291dba496f34f36c642a43e6999012f53daadf7bdfd965c29d7c1
SSDEEP 6144:XY7G21Ap+ly2WtzH7NrIrBJjvft5LZFL92hUPEIemdv:XY7GKAIYR0vfjZZ92hUHdv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1098318.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1098318.exe
Size 257KB
SHA256 7257939a69968858a56fbc2b7ceb0a0a90f2936d6fa1e03d45d820ac604d3ad6
MD5 dce347045d9509df1fedb318c1ccd4db
SHA1 6216c56ae94d6fb3761ea1dffb09511d0c9659db
SHA512 9a9d098ab62b85241af02e3e00d4b59e1e7106057926485c03ad1dd52d08976768093f70bde291dba496f34f36c642a43e6999012f53daadf7bdfd965c29d7c1
SSDEEP 6144:XY7G21Ap+ly2WtzH7NrIrBJjvft5LZFL92hUPEIemdv:XY7GKAIYR0vfjZZ92hUHdv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4024-153-0x0000000000580000-0x00000000005B0000-memory.dmp

Download

memory/4024-157-0x0000000004C50000-0x0000000005268000-memory.dmp

Download

memory/4024-158-0x0000000005380000-0x000000000548A000-memory.dmp

Download

memory/4024-159-0x0000000004B00000-0x0000000004B12000-memory.dmp

Download

memory/4024-160-0x0000000005270000-0x00000000052AC000-memory.dmp

Download

memory/4024-161-0x0000000004B40000-0x0000000004B50000-memory.dmp

Download

memory/4024-162-0x0000000004B40000-0x0000000004B50000-memory.dmp

Download

memory/4636-133-0x00000000007A0000-0x0000000000811000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads