redline | 47c01c5639bd704d9c36cfb69954210f6d7f3468437cc712d60e045d15cacdac

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4af597ac71483cc4a4435cb99a0fd186.exe
Size 513KB
Sample230710-mpdbpshg88
SHA256 47c01c5639bd704d9c36cfb69954210f6d7f3468437cc712d60e045d15cacdac
MD5 4af597ac71483cc4a4435cb99a0fd186
SHA1 bc119b7d2d24dcd7d8fb9ca17b2efa56ce46b81a
SHA512 6ab34f196c03feaf2ffbd639ac127571c74d70a0ad1095c7477d02d305b35f39b94fb03e3859f946f70e309e6fcf818553416bc34a44f824a3c13be39735fa48
SSDEEP 6144:Rk7/YCVRHBoQOmmkFNxhRBxhRBxhRBx+ueO+ueO+ueAR+ueO/vfP/vfP/vfP/TCu:RkUCFz47m7/Vz8DTDS6vJZVl8cc7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline kira infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1460	x7589457.exe
5100	f8280903.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4af597ac71483cc4a4435cb99a0fd186.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4af597ac71483cc4a4435cb99a0fd186.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7589457.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7589457.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 1460	488	4af597ac71483cc4a4435cb99a0fd186.exe	85
PID 488 wrote to memory of 1460	488	4af597ac71483cc4a4435cb99a0fd186.exe	85
PID 488 wrote to memory of 1460	488	4af597ac71483cc4a4435cb99a0fd186.exe	85
PID 1460 wrote to memory of 5100	1460	x7589457.exe	86
PID 1460 wrote to memory of 5100	1460	x7589457.exe	86
PID 1460 wrote to memory of 5100	1460	x7589457.exe	86

C:\Users\Admin\AppData\Local\Temp\4af597ac71483cc4a4435cb99a0fd186.exe
"C:\Users\Admin\AppData\Local\Temp\4af597ac71483cc4a4435cb99a0fd186.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7589457.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7589457.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8280903.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8280903.exe
    3⤵
    - Executes dropped EXE
    PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x7589457.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7589457.exe
Size 319KB
SHA256 9c908844eecb259c18bcb2066cf5b8714d8fbfebb6b16537b0e98f97f7ede0f2
MD5 db36237cfb0275e7986b2d7b2689a9ee
SHA1 3f99f31755222e60e27f918bfe0b23db5a567781
SHA512 89b428bc5e047660fd7fd5d96dd762d166c88e34995e5f9acdfef38f01c71e268ce3c90a0fa5d1fb328e65ad8caf7bb65bdad1322387f144a247eb9db3a13c7e
SSDEEP 6144:KWy+bnr+up0yN90QEGZeC4OGvfrGrxkw1CI3cBU/Vzt51N:aMrey90A14OGcl93c+Nzn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7589457.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7589457.exe
Size 319KB
SHA256 9c908844eecb259c18bcb2066cf5b8714d8fbfebb6b16537b0e98f97f7ede0f2
MD5 db36237cfb0275e7986b2d7b2689a9ee
SHA1 3f99f31755222e60e27f918bfe0b23db5a567781
SHA512 89b428bc5e047660fd7fd5d96dd762d166c88e34995e5f9acdfef38f01c71e268ce3c90a0fa5d1fb328e65ad8caf7bb65bdad1322387f144a247eb9db3a13c7e
SSDEEP 6144:KWy+bnr+up0yN90QEGZeC4OGvfrGrxkw1CI3cBU/Vzt51N:aMrey90A14OGcl93c+Nzn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8280903.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8280903.exe
Size 266KB
SHA256 833ab357095d573247b93c0c706306e893d1690d40669f98a30f250e95d11812
MD5 d201bc518b1e5c8605f46f4dbfa9b1bc
SHA1 e8f541be31b9d2edf41ad16b9b864f891d5708e9
SHA512 9b199121a9178ef3b65fca15c02d388cb19021727f78bf08ce2cddb614ac759c4601c573261b5c81ee6eb115fac2f55921499807b4e0643c2c1d2cc57e8c7b7d
SSDEEP 3072:Xvc+iOHMwew7+picM/ysVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:XvcvOswD7nVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8280903.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8280903.exe
Size 266KB
SHA256 833ab357095d573247b93c0c706306e893d1690d40669f98a30f250e95d11812
MD5 d201bc518b1e5c8605f46f4dbfa9b1bc
SHA1 e8f541be31b9d2edf41ad16b9b864f891d5708e9
SHA512 9b199121a9178ef3b65fca15c02d388cb19021727f78bf08ce2cddb614ac759c4601c573261b5c81ee6eb115fac2f55921499807b4e0643c2c1d2cc57e8c7b7d
SSDEEP 3072:Xvc+iOHMwew7+picM/ysVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:XvcvOswD7nVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/488-133-0x0000000000570000-0x00000000005DE000-memory.dmp

Download

memory/5100-153-0x0000000000520000-0x0000000000550000-memory.dmp

Download

memory/5100-157-0x0000000004BD0000-0x00000000051E8000-memory.dmp

Download

memory/5100-158-0x00000000051F0000-0x00000000052FA000-memory.dmp

Download

memory/5100-159-0x0000000005330000-0x0000000005342000-memory.dmp

Download

memory/5100-160-0x0000000005350000-0x000000000538C000-memory.dmp

Download

memory/5100-161-0x0000000002470000-0x0000000002480000-memory.dmp

Download

memory/5100-162-0x0000000002470000-0x0000000002480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads