redline | 6e9856822068b2fdcaab4cd9f9c247066344c4bbfac31b5d5de03b7313fea73b

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f75b0ec8632cd6f2e9b00857d6eb0455.exe
Size 513KB
Sample230710-pdrq3aab49
SHA256 6e9856822068b2fdcaab4cd9f9c247066344c4bbfac31b5d5de03b7313fea73b
MD5 f75b0ec8632cd6f2e9b00857d6eb0455
SHA1 cec89d81586e15dc029c3b368d33b4c70a1b9dc9
SHA512 b24ebed0cd15b593f03dc15394a34fbde242fd981908730663da28383a75a7fa8ad577211560cf9b1cf5bfa46b89ef9988877843a55cb03d1fd6f0c90aedbbf3
SSDEEP 12288:nekUCbz47t9juQtaq2iJ/tWlfQLU/7oL:nVv47t9aQtaqv/CKu7O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline kira infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1792	x1851157.exe
1468	f9546260.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1851157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1851157.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f75b0ec8632cd6f2e9b00857d6eb0455.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f75b0ec8632cd6f2e9b00857d6eb0455.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1792	4332	f75b0ec8632cd6f2e9b00857d6eb0455.exe	85
PID 4332 wrote to memory of 1792	4332	f75b0ec8632cd6f2e9b00857d6eb0455.exe	85
PID 4332 wrote to memory of 1792	4332	f75b0ec8632cd6f2e9b00857d6eb0455.exe	85
PID 1792 wrote to memory of 1468	1792	x1851157.exe	86
PID 1792 wrote to memory of 1468	1792	x1851157.exe	86
PID 1792 wrote to memory of 1468	1792	x1851157.exe	86

C:\Users\Admin\AppData\Local\Temp\f75b0ec8632cd6f2e9b00857d6eb0455.exe
"C:\Users\Admin\AppData\Local\Temp\f75b0ec8632cd6f2e9b00857d6eb0455.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1851157.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1851157.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9546260.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9546260.exe
    3⤵
    - Executes dropped EXE
    PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1851157.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1851157.exe
Size 319KB
SHA256 2075a69e55c1bed42004263bb8c27156cba29721d5acc2cdd4985ee31fdab34e
MD5 3f9559f5d10c61f6d1e71ed0e4b35917
SHA1 e33e157214c2513a9242a3c8afa404b264af3a15
SHA512 31392506c134ddc01149cbbfd586a7abd200f5840828291f4e71fbe22550429b82c07b2826b6b208305ab67087f1585c8e7a527af551d212c555c2295d32bdf4
SSDEEP 6144:Khy+bnr+Op0yN90QEBbq3Lo0sk+QM2Pk2J19lrPt:PMr6y90Dbq3Loora2J9Pt
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1851157.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1851157.exe
Size 319KB
SHA256 2075a69e55c1bed42004263bb8c27156cba29721d5acc2cdd4985ee31fdab34e
MD5 3f9559f5d10c61f6d1e71ed0e4b35917
SHA1 e33e157214c2513a9242a3c8afa404b264af3a15
SHA512 31392506c134ddc01149cbbfd586a7abd200f5840828291f4e71fbe22550429b82c07b2826b6b208305ab67087f1585c8e7a527af551d212c555c2295d32bdf4
SSDEEP 6144:Khy+bnr+Op0yN90QEBbq3Lo0sk+QM2Pk2J19lrPt:PMr6y90Dbq3Loora2J9Pt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9546260.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9546260.exe
Size 266KB
SHA256 21958aed62ba23706a0f85c5148ec276b5a52074c3953779c306f44f66b41f48
MD5 da9fc26d8fd7823142b26a314fa35c79
SHA1 96717d8f576b34b72239b12d32775784cb598699
SHA512 3ecdedb9819033ff94cb92f4596e6bb72d8b597a69cf7c559e94aba29cc9e326e106265b98f7022440e5ec7011de2adc6bf522274d11e7c0d3d32815c423b4c1
SSDEEP 3072:7Xc+iOHMwew7+picM/nsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:7XcvOswD7mVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

f9546260.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f9546260.exe
Size 266KB
SHA256 21958aed62ba23706a0f85c5148ec276b5a52074c3953779c306f44f66b41f48
MD5 da9fc26d8fd7823142b26a314fa35c79
SHA1 96717d8f576b34b72239b12d32775784cb598699
SHA512 3ecdedb9819033ff94cb92f4596e6bb72d8b597a69cf7c559e94aba29cc9e326e106265b98f7022440e5ec7011de2adc6bf522274d11e7c0d3d32815c423b4c1
SSDEEP 3072:7Xc+iOHMwew7+picM/nsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:7XcvOswD7mVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-153-0x0000000000520000-0x0000000000550000-memory.dmp

Download

memory/1468-157-0x00000000051D0000-0x00000000057E8000-memory.dmp

Download

memory/1468-158-0x0000000004BF0000-0x0000000004CFA000-memory.dmp

Download

memory/1468-159-0x0000000004D10000-0x0000000004D22000-memory.dmp

Download

memory/1468-160-0x0000000004D30000-0x0000000004D6C000-memory.dmp

Download

memory/1468-161-0x0000000002540000-0x0000000002550000-memory.dmp

Download

memory/1468-162-0x0000000002540000-0x0000000002550000-memory.dmp

Download

memory/4332-133-0x00000000005C0000-0x000000000062E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads