redline | ce9bc4c07bfce620e04a7e34b47a6ef3d58a2dce348fdbf83068a195545c31a0

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4f69cd57334be49170c7ab894dac316.exe
Size 514KB
Sample230710-pdq5jaba6v
SHA256 ce9bc4c07bfce620e04a7e34b47a6ef3d58a2dce348fdbf83068a195545c31a0
MD5 a4f69cd57334be49170c7ab894dac316
SHA1 5acbada37417214ec2db8feaae5e203b085dffdb
SHA512 c103f5d68c02103d241ee27448d9018e9fbb9e08164af61bf9796466ae83fca650b7f388214de0780cbc9813a7b3a6d7ee93c1af40e2a88c8691af889714813e
SSDEEP 6144:eWPD0GqUHBhiCWGYLUz2474VWNI/IzUuWVzvomUzx0CexpW3TTIvuEiEdThIpSqk:eWY+Az474Vn//ofzhD2D38A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline kira infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
3084	x2369029.exe
4504	f3708782.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a4f69cd57334be49170c7ab894dac316.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a4f69cd57334be49170c7ab894dac316.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2369029.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2369029.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3084	3624	a4f69cd57334be49170c7ab894dac316.exe	86
PID 3624 wrote to memory of 3084	3624	a4f69cd57334be49170c7ab894dac316.exe	86
PID 3624 wrote to memory of 3084	3624	a4f69cd57334be49170c7ab894dac316.exe	86
PID 3084 wrote to memory of 4504	3084	x2369029.exe	87
PID 3084 wrote to memory of 4504	3084	x2369029.exe	87
PID 3084 wrote to memory of 4504	3084	x2369029.exe	87

C:\Users\Admin\AppData\Local\Temp\a4f69cd57334be49170c7ab894dac316.exe
"C:\Users\Admin\AppData\Local\Temp\a4f69cd57334be49170c7ab894dac316.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2369029.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2369029.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3708782.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3708782.exe
    3⤵
    - Executes dropped EXE
    PID:4504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2369029.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2369029.exe
Size 319KB
SHA256 64f5cff061cb510cecf834e80d4b64e1a7aaa108b2960d8b1b169dd69fec0664
MD5 93cbc18ee90ee439f69c76e93a27569d
SHA1 33f176d61db81c14d5d8788c2ec382a1c8ac5035
SHA512 af2beb4a54e7f0eb8af6da3ca0a75d25eedbd156097868780665442137a442d1c08ff6494c009fe61ba2e6a54a0e294898ed819c09e752333f8deb9e4e39d6b4
SSDEEP 6144:KXy+bnr++p0yN90QELahOzsZVOncMMU91IrL2:tMrKy90HztcY9+f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2369029.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2369029.exe
Size 319KB
SHA256 64f5cff061cb510cecf834e80d4b64e1a7aaa108b2960d8b1b169dd69fec0664
MD5 93cbc18ee90ee439f69c76e93a27569d
SHA1 33f176d61db81c14d5d8788c2ec382a1c8ac5035
SHA512 af2beb4a54e7f0eb8af6da3ca0a75d25eedbd156097868780665442137a442d1c08ff6494c009fe61ba2e6a54a0e294898ed819c09e752333f8deb9e4e39d6b4
SSDEEP 6144:KXy+bnr++p0yN90QELahOzsZVOncMMU91IrL2:tMrKy90HztcY9+f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3708782.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3708782.exe
Size 266KB
SHA256 b1afb9ec88fc9508c7199a97eef4da5151f6d4e90d1d88584cdbff893a041a94
MD5 e50f3e73ed3ae6aa27fe1e64d59c0e85
SHA1 eddd20452d05b295df3ebd132cb0ef04e7f9ab9d
SHA512 9f43e74587d31feeaccfb72e79f5960f364501a02861b82885dc6c69b3f1845f7bc47b1bff68d153906fd7055a0d1ef88e65b6962b80e46ff55c1e26b8d21261
SSDEEP 3072:cRnHs+iOHMwew7+picM/PsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:EHsvOswD7uVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3708782.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3708782.exe
Size 266KB
SHA256 b1afb9ec88fc9508c7199a97eef4da5151f6d4e90d1d88584cdbff893a041a94
MD5 e50f3e73ed3ae6aa27fe1e64d59c0e85
SHA1 eddd20452d05b295df3ebd132cb0ef04e7f9ab9d
SHA512 9f43e74587d31feeaccfb72e79f5960f364501a02861b82885dc6c69b3f1845f7bc47b1bff68d153906fd7055a0d1ef88e65b6962b80e46ff55c1e26b8d21261
SSDEEP 3072:cRnHs+iOHMwew7+picM/PsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:EHsvOswD7uVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3624-133-0x0000000000490000-0x00000000004FE000-memory.dmp

Download

memory/4504-153-0x0000000000520000-0x0000000000550000-memory.dmp

Download

memory/4504-157-0x0000000009F90000-0x000000000A5A8000-memory.dmp

Download

memory/4504-158-0x000000000A610000-0x000000000A71A000-memory.dmp

Download

memory/4504-159-0x000000000A750000-0x000000000A762000-memory.dmp

Download

memory/4504-160-0x0000000004B00000-0x0000000004B10000-memory.dmp

Download

memory/4504-161-0x000000000A770000-0x000000000A7AC000-memory.dmp

Download

memory/4504-162-0x0000000004B00000-0x0000000004B10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads