redline | 2de2eb6efac18999983c337647f07b8dd31ebef6953f25cffa8b3b5ecf1a61a1

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edcfa609a5bd062c3044e3b96f3545dc.exe
Size 856KB
Sample230815-p33jvscg3w
SHA256 2de2eb6efac18999983c337647f07b8dd31ebef6953f25cffa8b3b5ecf1a61a1
MD5 edcfa609a5bd062c3044e3b96f3545dc
SHA1 ee1a895908015b9e9aa2c44fac1488f4398794cb
SHA512 793a923a09d5e2274e740bca24bab980323fe707ffc5cc0bf1f0472a8627e7dc2f86f408adf5aa748910b243a655a14a4c6f5a0ab5201e5e9448658e4674f32d
SSDEEP 24576:oyjoerOeepOyp80qBS5HElPefTo2fe2H:vjlazj8zJofT7f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline regta infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

regta

77.91.124.54:19071

Attributes

auth_value
c6f537c6f0415ea7760a9bc81f48c756

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
2272	v9726656.exe
4020	v6005454.exe
232	v7095950.exe
4868	v4546518.exe
400	a1564275.exe
4872	b7668444.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	edcfa609a5bd062c3044e3b96f3545dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9726656.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6005454.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7095950.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v4546518.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2272	3460	edcfa609a5bd062c3044e3b96f3545dc.exe	80
PID 3460 wrote to memory of 2272	3460	edcfa609a5bd062c3044e3b96f3545dc.exe	80
PID 3460 wrote to memory of 2272	3460	edcfa609a5bd062c3044e3b96f3545dc.exe	80
PID 2272 wrote to memory of 4020	2272	v9726656.exe	81
PID 2272 wrote to memory of 4020	2272	v9726656.exe	81
PID 2272 wrote to memory of 4020	2272	v9726656.exe	81
PID 4020 wrote to memory of 232	4020	v6005454.exe	82
PID 4020 wrote to memory of 232	4020	v6005454.exe	82
PID 4020 wrote to memory of 232	4020	v6005454.exe	82
PID 232 wrote to memory of 4868	232	v7095950.exe	83
PID 232 wrote to memory of 4868	232	v7095950.exe	83
PID 232 wrote to memory of 4868	232	v7095950.exe	83
PID 4868 wrote to memory of 400	4868	v4546518.exe	84
PID 4868 wrote to memory of 400	4868	v4546518.exe	84
PID 4868 wrote to memory of 400	4868	v4546518.exe	84
PID 4868 wrote to memory of 4872	4868	v4546518.exe	85
PID 4868 wrote to memory of 4872	4868	v4546518.exe	85
PID 4868 wrote to memory of 4872	4868	v4546518.exe	85

C:\Users\Admin\AppData\Local\Temp\edcfa609a5bd062c3044e3b96f3545dc.exe
"C:\Users\Admin\AppData\Local\Temp\edcfa609a5bd062c3044e3b96f3545dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9726656.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9726656.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6005454.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6005454.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7095950.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7095950.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4546518.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4546518.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1564275.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1564275.exe
        6⤵
        Executes dropped EXE
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7668444.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7668444.exe
        6⤵
        Executes dropped EXE
        
        PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v9726656.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9726656.exe
Size 724KB
SHA256 6c456ac950403844867aa6c8f06436005de2ec5ec14a131e0fc3357d93ab97ca
MD5 b8318723cafb5eb15211ccc922d3008d
SHA1 5759ca2ed7b0c7b635514e841b69a7bf64affc0b
SHA512 778f7f6053882b92e1c29e251e84bad817c371c6c0674736c2bfa1fe12e44f07b78dcba652ff6f3ccc64e81c96c4913fe68a6b6c86b945678e47c8f0a17e98e6
SSDEEP 12288:eMrwy908MSl0qkVJ3FbBSMgvH5jxPe0D0hMjsRYKPpVV//Up2w:6ydMSq3FbBSlH5lPeET0J/q2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

v9726656.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9726656.exe
Size 724KB
SHA256 6c456ac950403844867aa6c8f06436005de2ec5ec14a131e0fc3357d93ab97ca
MD5 b8318723cafb5eb15211ccc922d3008d
SHA1 5759ca2ed7b0c7b635514e841b69a7bf64affc0b
SHA512 778f7f6053882b92e1c29e251e84bad817c371c6c0674736c2bfa1fe12e44f07b78dcba652ff6f3ccc64e81c96c4913fe68a6b6c86b945678e47c8f0a17e98e6
SSDEEP 12288:eMrwy908MSl0qkVJ3FbBSMgvH5jxPe0D0hMjsRYKPpVV//Up2w:6ydMSq3FbBSlH5lPeET0J/q2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6005454.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6005454.exe
Size 599KB
SHA256 f5301d2b2497639e2e3eca7842d1836cc6b7a909af0601a09593cba9f7b3b9b1
MD5 b58337421052e97a063cb7f9aae5b664
SHA1 f042f81050a84f466e282328b357d828885bd3ac
SHA512 49776f2248a2970bf4cb379e5184faa7c5ca8c33e44ae46a69b1ea482dd25ef08b8f99bbecaa55011e76031a364eab3e1e746c8759488ebd3c2c15e302d9fbe2
SSDEEP 12288:4Mr8y902qfhDSZ9vvkjxPe0S0hMYsReKkpcV06Ufm:0y5qFSfvklPeFqYy6Am
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6005454.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6005454.exe
Size 599KB
SHA256 f5301d2b2497639e2e3eca7842d1836cc6b7a909af0601a09593cba9f7b3b9b1
MD5 b58337421052e97a063cb7f9aae5b664
SHA1 f042f81050a84f466e282328b357d828885bd3ac
SHA512 49776f2248a2970bf4cb379e5184faa7c5ca8c33e44ae46a69b1ea482dd25ef08b8f99bbecaa55011e76031a364eab3e1e746c8759488ebd3c2c15e302d9fbe2
SSDEEP 12288:4Mr8y902qfhDSZ9vvkjxPe0S0hMYsReKkpcV06Ufm:0y5qFSfvklPeFqYy6Am
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7095950.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7095950.exe
Size 372KB
SHA256 05fbe22760b0b50537c4d826008c6c87ee0a9c7415f47c77280f324b6ddabfde
MD5 bd793765547519c2ae8be70259d03915
SHA1 a896b514f88e951987d75d56bb32f3d19e8962ac
SHA512 36db180ea530a5446eaacaeee9718f6b7ab07a4fcd0c4f1734b9a5804af69360891861c1cb8be44a965967549011a00b59ef150f035d678b0a14978f74eb33a4
SSDEEP 6144:K8y+bnr+Dp0yN90QECJI33ZFBMwsuQcxPe0l0hMdBSkQxPH5ziDMkpZa9:4Mr/y90F5FnjxPe0l0hMSTRQokp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7095950.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7095950.exe
Size 372KB
SHA256 05fbe22760b0b50537c4d826008c6c87ee0a9c7415f47c77280f324b6ddabfde
MD5 bd793765547519c2ae8be70259d03915
SHA1 a896b514f88e951987d75d56bb32f3d19e8962ac
SHA512 36db180ea530a5446eaacaeee9718f6b7ab07a4fcd0c4f1734b9a5804af69360891861c1cb8be44a965967549011a00b59ef150f035d678b0a14978f74eb33a4
SSDEEP 6144:K8y+bnr+Dp0yN90QECJI33ZFBMwsuQcxPe0l0hMdBSkQxPH5ziDMkpZa9:4Mr/y90F5FnjxPe0l0hMSTRQokp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4546518.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4546518.exe
Size 271KB
SHA256 68d5d5a9073867a19b87f13f546940a1f9b5c9d59179a0ee6d43998c54d51489
MD5 282da66333c04ef10c034ff39701a30d
SHA1 17400cbbebbbb7eae052bbf0fceef465467c627a
SHA512 1705c8987396239ff8d0a0bce3683a7316be60148fffb1b62997f65ed4d87c4784da9cbb1be37226b5e8c5085ab985cfe5670ffb19e5653ef9a121dfe639f9f7
SSDEEP 6144:KGy+bnr+Op0yN90QEw0hMdGSkQxPH7zex+AVj21l6t3U:iMray90G0hHSTRO0A8lWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4546518.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4546518.exe
Size 271KB
SHA256 68d5d5a9073867a19b87f13f546940a1f9b5c9d59179a0ee6d43998c54d51489
MD5 282da66333c04ef10c034ff39701a30d
SHA1 17400cbbebbbb7eae052bbf0fceef465467c627a
SHA512 1705c8987396239ff8d0a0bce3683a7316be60148fffb1b62997f65ed4d87c4784da9cbb1be37226b5e8c5085ab985cfe5670ffb19e5653ef9a121dfe639f9f7
SSDEEP 6144:KGy+bnr+Op0yN90QEw0hMdGSkQxPH7zex+AVj21l6t3U:iMray90G0hHSTRO0A8lWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1564275.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1564275.exe
Size 140KB
SHA256 b6334ee729f1dc1e531da0ca694e42520d59e1b483e36fd1415f1693417a7d02
MD5 70434f2512ce43babd31bef999c1f6c7
SHA1 7729f782166d1d3b0b54fa14ff29d9e7e91eeadf
SHA512 cfe18ba0ae2a726c0aca539922dd1a3920a1a4cc03b8224868c9dd22635ce73f8de7b1af3afec686dc16152fa8d267652e43391f5d51ded913d6990fd609ff56
SSDEEP 3072:b3A8KzSuU+dO/pLE0C4Hg2wI83XNS75vO9YmZzPda9cVJ:bkzSfQ0DrOcyVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1564275.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1564275.exe
Size 140KB
SHA256 b6334ee729f1dc1e531da0ca694e42520d59e1b483e36fd1415f1693417a7d02
MD5 70434f2512ce43babd31bef999c1f6c7
SHA1 7729f782166d1d3b0b54fa14ff29d9e7e91eeadf
SHA512 cfe18ba0ae2a726c0aca539922dd1a3920a1a4cc03b8224868c9dd22635ce73f8de7b1af3afec686dc16152fa8d267652e43391f5d51ded913d6990fd609ff56
SSDEEP 3072:b3A8KzSuU+dO/pLE0C4Hg2wI83XNS75vO9YmZzPda9cVJ:bkzSfQ0DrOcyVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7668444.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7668444.exe
Size 174KB
SHA256 ec64ea527173c4f6c8bac9f67019bc48e7c929b7ce57c1d9d6ec377680c0945c
MD5 34297d7a30da82394d8ce41e58ef65c2
SHA1 11454edf5150abe63cbffde586c2860dab6932c8
SHA512 8b808accf39ab5da66b22228fd5ca7547236c4bbc03b2a6ec3b966cea4a5d0fee4387a71b64ff3310616e95ae4aec4ee886d84cf4eecf70dfba50e2240e8e801
SSDEEP 3072:8QiX1vTI0EVXvWOti2i6t8CE0CI0XkNvlnMDJz8e8hZ:8QgTI0EVXvV8CE0KkNvlnMDF
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7668444.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7668444.exe
Size 174KB
SHA256 ec64ea527173c4f6c8bac9f67019bc48e7c929b7ce57c1d9d6ec377680c0945c
MD5 34297d7a30da82394d8ce41e58ef65c2
SHA1 11454edf5150abe63cbffde586c2860dab6932c8
SHA512 8b808accf39ab5da66b22228fd5ca7547236c4bbc03b2a6ec3b966cea4a5d0fee4387a71b64ff3310616e95ae4aec4ee886d84cf4eecf70dfba50e2240e8e801
SSDEEP 3072:8QiX1vTI0EVXvWOti2i6t8CE0CI0XkNvlnMDJz8e8hZ:8QgTI0EVXvV8CE0KkNvlnMDF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4872-171-0x0000000000E30000-0x0000000000E60000-memory.dmp

Download

memory/4872-172-0x0000000074B00000-0x00000000752B0000-memory.dmp

Download

memory/4872-173-0x0000000005EC0000-0x00000000064D8000-memory.dmp

Download

memory/4872-174-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Download

memory/4872-175-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/4872-176-0x0000000005900000-0x0000000005912000-memory.dmp

Download

memory/4872-177-0x0000000005960000-0x000000000599C000-memory.dmp

Download

memory/4872-178-0x0000000074B00000-0x00000000752B0000-memory.dmp

Download

memory/4872-179-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads