redline | 517247ce4e98482eb2043297075e2e14622f08d2add7ea105ea7612988b10e90

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
daa0e2f84899b97c9e9e3999d83dd4b5.exe
Size 854KB
Sample230818-tdb3tsbf25
SHA256 517247ce4e98482eb2043297075e2e14622f08d2add7ea105ea7612988b10e90
MD5 daa0e2f84899b97c9e9e3999d83dd4b5
SHA1 9655241a1354a83a8312a9ef45d9f4898564b860
SHA512 b4c22eb01e226bee7d8386eab5adc2c1474e07684e70cf2c9d0c919de1a87a9fc41e40181d299cccffba482d380293e15b11666382bc525c9fae575b2cf75847
SSDEEP 24576:1yQphvWzXoJAFvibIueppg+w19ncWYeQum:Q6Ib6AYLofGn7YeQu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline dugin infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

dugin

77.91.124.73:19071

Attributes

auth_value
7c3e46e091100fd26a6076996d374c28

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 6 IoCs

pid	Process
488	v5463759.exe
1068	v6245310.exe
1748	v7535608.exe
3124	v8753963.exe
4828	a9190910.exe
4752	b3803369.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6245310.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7535608.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v8753963.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	daa0e2f84899b97c9e9e3999d83dd4b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5463759.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 488	1552	daa0e2f84899b97c9e9e3999d83dd4b5.exe	81
PID 1552 wrote to memory of 488	1552	daa0e2f84899b97c9e9e3999d83dd4b5.exe	81
PID 1552 wrote to memory of 488	1552	daa0e2f84899b97c9e9e3999d83dd4b5.exe	81
PID 488 wrote to memory of 1068	488	v5463759.exe	82
PID 488 wrote to memory of 1068	488	v5463759.exe	82
PID 488 wrote to memory of 1068	488	v5463759.exe	82
PID 1068 wrote to memory of 1748	1068	v6245310.exe	83
PID 1068 wrote to memory of 1748	1068	v6245310.exe	83
PID 1068 wrote to memory of 1748	1068	v6245310.exe	83
PID 1748 wrote to memory of 3124	1748	v7535608.exe	84
PID 1748 wrote to memory of 3124	1748	v7535608.exe	84
PID 1748 wrote to memory of 3124	1748	v7535608.exe	84
PID 3124 wrote to memory of 4828	3124	v8753963.exe	85
PID 3124 wrote to memory of 4828	3124	v8753963.exe	85
PID 3124 wrote to memory of 4828	3124	v8753963.exe	85
PID 3124 wrote to memory of 4752	3124	v8753963.exe	86
PID 3124 wrote to memory of 4752	3124	v8753963.exe	86
PID 3124 wrote to memory of 4752	3124	v8753963.exe	86

C:\Users\Admin\AppData\Local\Temp\daa0e2f84899b97c9e9e3999d83dd4b5.exe
"C:\Users\Admin\AppData\Local\Temp\daa0e2f84899b97c9e9e3999d83dd4b5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5463759.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5463759.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6245310.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6245310.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7535608.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7535608.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8753963.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8753963.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9190910.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9190910.exe
        6⤵
        Executes dropped EXE
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3803369.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3803369.exe
        6⤵
        Executes dropped EXE
        
        PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v5463759.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5463759.exe
Size 722KB
SHA256 ed878f61c8e2b12e6906154706ffa33ca8a4098be8778f9134af0687205ed9ae
MD5 2daa1b8fbe5f21f7439e325d7fcdb905
SHA1 47ef1d816b5005ef8fe9a0211dff7cf166dfae04
SHA512 21a65f0fc651d267def7cba98f31de86ec12f97c0b5efbd8b1c78d09d7ef95574c23278bfc2164824849cd25679b7b888cbdda5d1e6495371c16b8aeef9d942e
SSDEEP 12288:xMrqy904RfvEeFVB2xvbQnU09yodHAuHcibIDlep7KD3awCaxMggm/+Dclwo:XybRke2vbiUo1Au8ibIxep7+KwRxnDWK
MD5 SHA1 SHA512 SSDEEP

Submit Download

v5463759.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5463759.exe
Size 722KB
SHA256 ed878f61c8e2b12e6906154706ffa33ca8a4098be8778f9134af0687205ed9ae
MD5 2daa1b8fbe5f21f7439e325d7fcdb905
SHA1 47ef1d816b5005ef8fe9a0211dff7cf166dfae04
SHA512 21a65f0fc651d267def7cba98f31de86ec12f97c0b5efbd8b1c78d09d7ef95574c23278bfc2164824849cd25679b7b888cbdda5d1e6495371c16b8aeef9d942e
SSDEEP 12288:xMrqy904RfvEeFVB2xvbQnU09yodHAuHcibIDlep7KD3awCaxMggm/+Dclwo:XybRke2vbiUo1Au8ibIxep7+KwRxnDWK
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6245310.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6245310.exe
Size 598KB
SHA256 19dd3636aa78db6d9f8a1354c5f3ea1663f9f404e65bb6a8284e869cd6e753e1
MD5 cb3aa209fc0ce21ad6dce404c10d3729
SHA1 e42e897b2083df5c9788a0b773a7223503df3476
SHA512 c5b863d6ba5fc815b7072209433919ee3dbe8710921d0193186eff670959e20cdff9462295c89d02137de18567b92cd7e26e7fad8e2977522e2e6be5a70337b9
SSDEEP 12288:6MrGy90oRnU0cUoH7Auk5D0bqlled7Kh3XwCdJMgCm/L:oyxtrobAukp0bwed7knw+Jn5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6245310.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6245310.exe
Size 598KB
SHA256 19dd3636aa78db6d9f8a1354c5f3ea1663f9f404e65bb6a8284e869cd6e753e1
MD5 cb3aa209fc0ce21ad6dce404c10d3729
SHA1 e42e897b2083df5c9788a0b773a7223503df3476
SHA512 c5b863d6ba5fc815b7072209433919ee3dbe8710921d0193186eff670959e20cdff9462295c89d02137de18567b92cd7e26e7fad8e2977522e2e6be5a70337b9
SSDEEP 12288:6MrGy90oRnU0cUoH7Auk5D0bqlled7Kh3XwCdJMgCm/L:oyxtrobAukp0bwed7knw+Jn5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7535608.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7535608.exe
Size 372KB
SHA256 0619bdce582bb759a788a5849ef1501b7b271e45e18975086d0d86e3bd0f3186
MD5 bf817de93c2d988f64a6c6537121a278
SHA1 8b2083309521d194efde63f6f29c0c75742bd9aa
SHA512 c1f00de7c08b1db68a920ab8804a77e0f7fe604e2148e93281e2eda447af4f0950fbea7c5692ca52d5c6b0b8dc94350c49ae0ea453f329cc3f37bdd6e0d4d456
SSDEEP 6144:Kfy+bnr+3p0yN90QEOu44eGi2Tx3Nal5s7f7jH90cq7PxlFqdsfVAv3E6MMCUqsk:RMrTy90fLeGi2Zgvs7DZbqllAd4Kv3Hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7535608.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7535608.exe
Size 372KB
SHA256 0619bdce582bb759a788a5849ef1501b7b271e45e18975086d0d86e3bd0f3186
MD5 bf817de93c2d988f64a6c6537121a278
SHA1 8b2083309521d194efde63f6f29c0c75742bd9aa
SHA512 c1f00de7c08b1db68a920ab8804a77e0f7fe604e2148e93281e2eda447af4f0950fbea7c5692ca52d5c6b0b8dc94350c49ae0ea453f329cc3f37bdd6e0d4d456
SSDEEP 6144:Kfy+bnr+3p0yN90QEOu44eGi2Tx3Nal5s7f7jH90cq7PxlFqdsfVAv3E6MMCUqsk:RMrTy90fLeGi2Zgvs7DZbqllAd4Kv3Hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8753963.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8753963.exe
Size 271KB
SHA256 1b5c69b40a1257df38c2c381b42dbe17d02bd07416a295bf3835e5807514d0bc
MD5 baafa70caf3ce0c2e1860485f961c67b
SHA1 029aa517589547c652a7ddc9e3ca27dbf7b57792
SHA512 fe429f8277f5b5528fa027e88a69c9db5eec4d6b47e2a0aa001a08b1672744c74a9453db42ff8ff98d5d4b03f5746020add73fd33880e123590d6ac1c64b5a8c
SSDEEP 6144:KHy+bnr++p0yN90QEHpyilaZ/hLt0Y1W8y0Q:tMruy90nyi0Zp6zF
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8753963.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8753963.exe
Size 271KB
SHA256 1b5c69b40a1257df38c2c381b42dbe17d02bd07416a295bf3835e5807514d0bc
MD5 baafa70caf3ce0c2e1860485f961c67b
SHA1 029aa517589547c652a7ddc9e3ca27dbf7b57792
SHA512 fe429f8277f5b5528fa027e88a69c9db5eec4d6b47e2a0aa001a08b1672744c74a9453db42ff8ff98d5d4b03f5746020add73fd33880e123590d6ac1c64b5a8c
SSDEEP 6144:KHy+bnr++p0yN90QEHpyilaZ/hLt0Y1W8y0Q:tMruy90nyi0Zp6zF
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9190910.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9190910.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9190910.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9190910.exe
Size 140KB
SHA256 0fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
MD5 77a93a6afb1d7fa81c674cbecbee8531
SHA1 fbd5275cea45278e48c3306c5e069619cdf038b3
SHA512 dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
SSDEEP 3072:x3A8KZSuCoIO/pLS0CvFOdVBf2FwUZWUE9wpDV+hb5lPmZzP8aKVJ:xkZSiO0pBE+55YKVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3803369.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3803369.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3803369.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3803369.exe
Size 173KB
SHA256 64b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
MD5 d5f3785f09b0b4ddb516cb1bba85a36d
SHA1 978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA512 40f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
SSDEEP 3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4752-171-0x0000000000440000-0x0000000000470000-memory.dmp

Download

memory/4752-172-0x0000000074180000-0x0000000074930000-memory.dmp

Download

memory/4752-173-0x00000000053F0000-0x0000000005A08000-memory.dmp

Download

memory/4752-174-0x0000000004EE0000-0x0000000004FEA000-memory.dmp

Download

memory/4752-176-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download

memory/4752-175-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Download

memory/4752-177-0x0000000004E30000-0x0000000004E6C000-memory.dmp

Download

memory/4752-178-0x0000000074180000-0x0000000074930000-memory.dmp

Download

memory/4752-179-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads