redline | 02e6af84d0a582076e75f2e0c47e95f1e832ab78dd107242f62acff3ff65b2da

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
847a8995439cdee9f8a00c33918292d4.exe
Size 517KB
Sample230707-yrh6hsbb63
SHA256 02e6af84d0a582076e75f2e0c47e95f1e832ab78dd107242f62acff3ff65b2da
MD5 847a8995439cdee9f8a00c33918292d4
SHA1 6815b2579b8224b3f6b3e76333014844b70f540d
SHA512 718f3aab87ad44aa12d3c268a2131a0ccf95af08705a3d4bd5a3a5d390b56c0addaa0038669bace92c0fb036778a1dca9f99616e78e581c30de56ad52592b372
SSDEEP 12288:h/2qYfvjaRdnQgHbGDGmlAjuJOXaS03v/Wvcw1qH/vT3:h/2qyvj82ga7E033WvH1qD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline furod infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

furod

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1424	x4563195.exe
1404	f2261740.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	847a8995439cdee9f8a00c33918292d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	847a8995439cdee9f8a00c33918292d4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4563195.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4563195.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 1424	4032	847a8995439cdee9f8a00c33918292d4.exe	85
PID 4032 wrote to memory of 1424	4032	847a8995439cdee9f8a00c33918292d4.exe	85
PID 4032 wrote to memory of 1424	4032	847a8995439cdee9f8a00c33918292d4.exe	85
PID 1424 wrote to memory of 1404	1424	x4563195.exe	86
PID 1424 wrote to memory of 1404	1424	x4563195.exe	86
PID 1424 wrote to memory of 1404	1424	x4563195.exe	86

C:\Users\Admin\AppData\Local\Temp\847a8995439cdee9f8a00c33918292d4.exe
"C:\Users\Admin\AppData\Local\Temp\847a8995439cdee9f8a00c33918292d4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4563195.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4563195.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f2261740.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f2261740.exe
    3⤵
    - Executes dropped EXE
    PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x4563195.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4563195.exe
Size 331KB
SHA256 703d74d603a85ac75faa6a10cc4bf08c898db685af5370ccf5c8134a2a25a3d1
MD5 ea024d405e482485560f75c3cfc9cc00
SHA1 1debe72970db4165c9d37382ed476972df7817ef
SHA512 0ea6003426b550519dce38be317a43c7e3b48c5a2a7bf13761a87e2d1ea2ff5f1b74ed2e5441145341c5d7e77e6b1b7ee3a033f89cddeeb3e5034db124cbb130
SSDEEP 6144:K4y+bnr+op0yN90QElCSscQwfHYLxCIIN7k3ts6UKOJGBCY8p+:4Mr0y90TCSqOYL457ss6UKHc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4563195.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4563195.exe
Size 331KB
SHA256 703d74d603a85ac75faa6a10cc4bf08c898db685af5370ccf5c8134a2a25a3d1
MD5 ea024d405e482485560f75c3cfc9cc00
SHA1 1debe72970db4165c9d37382ed476972df7817ef
SHA512 0ea6003426b550519dce38be317a43c7e3b48c5a2a7bf13761a87e2d1ea2ff5f1b74ed2e5441145341c5d7e77e6b1b7ee3a033f89cddeeb3e5034db124cbb130
SSDEEP 6144:K4y+bnr+op0yN90QElCSscQwfHYLxCIIN7k3ts6UKOJGBCY8p+:4Mr0y90TCSqOYL457ss6UKHc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2261740.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f2261740.exe
Size 257KB
SHA256 c4d52c8042e9aca93a242ab96b671176d0e6a964a42a389648827c6a4b01db3b
MD5 f9ee1f25a5bec68fb3820285e7bb5b9d
SHA1 9ad199805dd6da333fba6bdb33c5c65d35fcab61
SHA512 d67b9165ecfc1a9e09eb530590f25b55cd9c6b8aadb7e1f46ef5678c0f14d322e1c80c84e5331659d8ce981622ce07b95aeed71225255ae43dda54f811992fc5
SSDEEP 6144:MHYoayBiwp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIHy:0YoayBtIYR0vfjZZ92hUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2261740.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f2261740.exe
Size 257KB
SHA256 c4d52c8042e9aca93a242ab96b671176d0e6a964a42a389648827c6a4b01db3b
MD5 f9ee1f25a5bec68fb3820285e7bb5b9d
SHA1 9ad199805dd6da333fba6bdb33c5c65d35fcab61
SHA512 d67b9165ecfc1a9e09eb530590f25b55cd9c6b8aadb7e1f46ef5678c0f14d322e1c80c84e5331659d8ce981622ce07b95aeed71225255ae43dda54f811992fc5
SSDEEP 6144:MHYoayBiwp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIHy:0YoayBtIYR0vfjZZ92hUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1404-153-0x0000000000570000-0x00000000005A0000-memory.dmp

Download

memory/1404-157-0x000000000A700000-0x000000000AD18000-memory.dmp

Download

memory/1404-158-0x000000000A140000-0x000000000A24A000-memory.dmp

Download

memory/1404-159-0x000000000A280000-0x000000000A292000-memory.dmp

Download

memory/1404-160-0x000000000A2A0000-0x000000000A2DC000-memory.dmp

Download

memory/1404-161-0x0000000004D50000-0x0000000004D60000-memory.dmp

Download

memory/1404-162-0x0000000004D50000-0x0000000004D60000-memory.dmp

Download

memory/4032-133-0x0000000000860000-0x00000000008D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads