redline | 3cc25e5af5617ca1aacaaeccb9cef517a8e39ec5b9af26fec1f10ded7242eed2

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 847KB
Sample230818-pg6dmahd82
SHA256 3cc25e5af5617ca1aacaaeccb9cef517a8e39ec5b9af26fec1f10ded7242eed2
MD5 4abd09baa41dd15a9c75dc03d2c5df59
SHA1 dbfd1cade398c252a3e43edfd2024ce8eb58d370
SHA512 046b5ceeced84a7e833acaebd945f6ee8eae8c44c1c4475d4b1d42353ff9222c27b04e94c43fc06e91501dde6301ec8582265e2fe646d259b4eddd548ecfae60
SSDEEP 12288:lMrPy90OvFJ28hbhouhsJRoZe8tZZfa3HUAtyGS233JspxvtQzPIwN37aTSkkE38:uyRHrpbhsTar1iUGZ+xyzPPraTW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dugin infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dugin

77.91.124.73:19071

Attributes

auth_value
7c3e46e091100fd26a6076996d374c28

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
988	v7110242.exe
3276	v7285812.exe
1408	v8659982.exe
1512	v7975226.exe
5004	a5839558.exe
3732	b8558259.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7110242.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7285812.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8659982.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v7975226.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 988	908	file.exe	81
PID 908 wrote to memory of 988	908	file.exe	81
PID 908 wrote to memory of 988	908	file.exe	81
PID 988 wrote to memory of 3276	988	v7110242.exe	82
PID 988 wrote to memory of 3276	988	v7110242.exe	82
PID 988 wrote to memory of 3276	988	v7110242.exe	82
PID 3276 wrote to memory of 1408	3276	v7285812.exe	83
PID 3276 wrote to memory of 1408	3276	v7285812.exe	83
PID 3276 wrote to memory of 1408	3276	v7285812.exe	83
PID 1408 wrote to memory of 1512	1408	v8659982.exe	84
PID 1408 wrote to memory of 1512	1408	v8659982.exe	84
PID 1408 wrote to memory of 1512	1408	v8659982.exe	84
PID 1512 wrote to memory of 5004	1512	v7975226.exe	85
PID 1512 wrote to memory of 5004	1512	v7975226.exe	85
PID 1512 wrote to memory of 5004	1512	v7975226.exe	85
PID 1512 wrote to memory of 3732	1512	v7975226.exe	86
PID 1512 wrote to memory of 3732	1512	v7975226.exe	86
PID 1512 wrote to memory of 3732	1512	v7975226.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7110242.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7110242.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7285812.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7285812.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8659982.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8659982.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7975226.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7975226.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5839558.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5839558.exe
        6⤵
        Executes dropped EXE
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8558259.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8558259.exe
        6⤵
        Executes dropped EXE
        
        PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v7110242.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7110242.exe
Size 723KB
SHA256 db35d3a49163dcc9b2149a803d3644a126e2f6e2620671fec75405baa14bd241
MD5 33dd48aae0c215de63432ba4bce52a5f
SHA1 1c5198543e37c609b1b9a6f2841641b17d5e27da
SHA512 13ac7b8ce64b03dfa37121aff38c2a6fa5d2ef8c9f44be25d8c52b3868b82f6b9d1df209e81e44d165a769e59707ec8779ae73680250aac142b479614dede1b4
SSDEEP 12288:FMr2y90EHGRyJwoUeCf5Vv3HUAIyqW23ZJuGxvOQXPywN37JESkQc:jydMyCDDfvPqFxxRXPhrJEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7110242.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7110242.exe
Size 723KB
SHA256 db35d3a49163dcc9b2149a803d3644a126e2f6e2620671fec75405baa14bd241
MD5 33dd48aae0c215de63432ba4bce52a5f
SHA1 1c5198543e37c609b1b9a6f2841641b17d5e27da
SHA512 13ac7b8ce64b03dfa37121aff38c2a6fa5d2ef8c9f44be25d8c52b3868b82f6b9d1df209e81e44d165a769e59707ec8779ae73680250aac142b479614dede1b4
SSDEEP 12288:FMr2y90EHGRyJwoUeCf5Vv3HUAIyqW23ZJuGxvOQXPywN37JESkQc:jydMyCDDfvPqFxxRXPhrJEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7285812.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7285812.exe
Size 598KB
SHA256 e610ec00624f262580f6bfca726832842a59e9503394ac18c744ab5ff98cd43a
MD5 9f08a3ebac484943fefa3a891bdb754e
SHA1 84b59e63e0297c3fdae8fee30771c9f0c374e876
SHA512 6cba7ae914689ca582a62c672d893b24e26fb447571b127f95e71de19e1b5e682c1a1686f8e90a88d55094d9b5b5ed1829b39e77b53d5d256ce0bab903e2e825
SSDEEP 12288:dMray90Gusrg5VT31UAWyq02iZZvaxvJQ0PywNC7JSSk2:Dy43T3qKyxW0PhAJSs
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7285812.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7285812.exe
Size 598KB
SHA256 e610ec00624f262580f6bfca726832842a59e9503394ac18c744ab5ff98cd43a
MD5 9f08a3ebac484943fefa3a891bdb754e
SHA1 84b59e63e0297c3fdae8fee30771c9f0c374e876
SHA512 6cba7ae914689ca582a62c672d893b24e26fb447571b127f95e71de19e1b5e682c1a1686f8e90a88d55094d9b5b5ed1829b39e77b53d5d256ce0bab903e2e825
SSDEEP 12288:dMray90Gusrg5VT31UAWyq02iZZvaxvJQ0PywNC7JSSk2:Dy43T3qKyxW0PhAJSs
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8659982.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8659982.exe
Size 372KB
SHA256 1349ae37e82f5c1fc26a7f43da242506e3812cc097ff94504ad2bc54cc25d5d8
MD5 9c674d7f44718bc6906deb0d43f75d73
SHA1 1cfdd23c3fa74cbf4b7305d92a7dda0c2280d870
SHA512 89ad8d3241a80481a1154adee742cb27ad2eb5f73a72beeff0c2e14554f41b42b45bc3f08a9f99ca51ea3c53a36a38ce57edde0e246365218f6590ffe59955da
SSDEEP 6144:K7y+bnr+np0yN90QECyaQlwKCyqkpsilcZXjc+7nv2tJ:tMrzy90NaMwKCyqEsimZXfnvIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8659982.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8659982.exe
Size 372KB
SHA256 1349ae37e82f5c1fc26a7f43da242506e3812cc097ff94504ad2bc54cc25d5d8
MD5 9c674d7f44718bc6906deb0d43f75d73
SHA1 1cfdd23c3fa74cbf4b7305d92a7dda0c2280d870
SHA512 89ad8d3241a80481a1154adee742cb27ad2eb5f73a72beeff0c2e14554f41b42b45bc3f08a9f99ca51ea3c53a36a38ce57edde0e246365218f6590ffe59955da
SSDEEP 6144:K7y+bnr+np0yN90QECyaQlwKCyqkpsilcZXjc+7nv2tJ:tMrzy90NaMwKCyqEsimZXfnvIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7975226.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7975226.exe
Size 271KB
SHA256 027503efe6f27f6d9b4c091531570dee0bca3b357c4de7eabe0ff321d63e910f
MD5 92a5dce66b449f4672e130ebda6fbe59
SHA1 88b25da7ce1590c42cd31b014dbd149c1cbb0de1
SHA512 b8c7244329b30735a9ad497659fb3615b62a032a253cd3b438ea868df1ce058a4ff388e34d71586850e4f65212ff8588140082fc0735fd7c9091c13fd4f4496a
SSDEEP 6144:Kty+bnr+ap0yN90QEtpyilaZ/hLt0Y1W8y06:bMrqy90Byi0Zp6z7
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7975226.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7975226.exe
Size 271KB
SHA256 027503efe6f27f6d9b4c091531570dee0bca3b357c4de7eabe0ff321d63e910f
MD5 92a5dce66b449f4672e130ebda6fbe59
SHA1 88b25da7ce1590c42cd31b014dbd149c1cbb0de1
SHA512 b8c7244329b30735a9ad497659fb3615b62a032a253cd3b438ea868df1ce058a4ff388e34d71586850e4f65212ff8588140082fc0735fd7c9091c13fd4f4496a
SSDEEP 6144:Kty+bnr+ap0yN90QEtpyilaZ/hLt0Y1W8y06:bMrqy90Byi0Zp6z7
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5839558.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5839558.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a5839558.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5839558.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8558259.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8558259.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

b8558259.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8558259.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3732-171-0x0000000074630000-0x0000000074DE0000-memory.dmp

Download

memory/3732-172-0x0000000000020000-0x0000000000050000-memory.dmp

Download

memory/3732-173-0x000000000A450000-0x000000000AA68000-memory.dmp

Download

memory/3732-174-0x0000000009FD0000-0x000000000A0DA000-memory.dmp

Download

memory/3732-176-0x0000000009F10000-0x0000000009F22000-memory.dmp

Download

memory/3732-175-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/3732-177-0x0000000009F70000-0x0000000009FAC000-memory.dmp

Download

memory/3732-178-0x0000000074630000-0x0000000074DE0000-memory.dmp

Download

memory/3732-179-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads